I used Flameshot for half a decade until about 2 years ago when I switched to whatever comes with KDE because I switched to KDE from Gnome. So no, not malware. It's just existed for quite a while.