Do nulled scripts contain malware?

It also depends on the source of the nulled scripts, if it's from a reputable site then there is a lesser chance of this, best bet is to manually check and test it in a non production environment.