The potentially nefarious plugin might filter itself out of the plugins list table by attaching a filter callback to all_plugins hook, which is used in WP_Plugins_List_Table->prepare_items().
One option could be that you inspect the global $wp_filter variable and see, if there are any suspicious (but what counts as suspicious?) callbacks attached to the above hook.
Another option is to mimic what the list table is doing, but compare the raw and filtered results of get_plugins() to see, if there are potentially hidden plugins.
$all_plugins = get_plugins();
// from wp-admin/includes/class-wp-plugins-list-table.php:104
$potentially_filtered_plugins = apply_filters( 'all_plugins', $all_plugins );
if ( count($all_plugins) !== count($potentially_filtered_plugins) ) {
echo 'There might be hidden plugins on your site.'
}
// foreach $all_plugins to render a list of plugins in the plugins dir
These are perhaps a little naive solutions, but build upon what WP is doing already.