Do nulled scripts contain malware?

Some of them contain backdoor. The nulled creator could obtain access to your site, files, etc. It's best to check the nulled script code manually for anything like that.