I'd write simply "make sure that it contains no malware" but the (awkward, not recommended) analogue to sugar-free here is malware-containing.
To contain means "to hold" or "to have in itself". We can say mineral-containing water or mineral-holding water but not "mineral-held water" and not "water which is mineral-held".
If you consider the verbs hold and contain, it becomes clear that two entities are (implicitly) involved: the holder|container and the thing that is held|contained.
When we form an adjective from the past-participle of these bare infinitives (contained, held), the adjective refers to the passive entity (that which is held) not to the active entity (that which holds).
To refer to the active entity adjectivally, we must use the present participle: holding, containing.
But that is awkward, as I wrote earlier, and it's better to say "does not contain", that is, better to express the idea with subject and verb than with subject and adjective.