This doesn't make it malware, as likely as it is that malware would hide itself like that. base64 encoding avoids issues with quoting and escaping in the terminal, and is an easy way to include a bit of binary data that might be needed by a command (or even just written directly to disk somewhere). "Obfuscated base64" is only saying something if you decoded the base64 and still got an obfuscated result. Install-time code execution is more dangerous in the sense that you can't review between installation and program execution; but custom installers come from the same source as the program, so it's the same number of parties to trust.
For that matter, PyPA still maintains bootstrap.pypa.io so that Python users can get current versions of pip by downloading and running a Python script that loads a base85 string, decodes it and writes a wheel file based on that. (It even duplicates some of the standard library `ensurepip` logic.)
If you want a malware report to be taken seriously, in general, you should expect to roll up your sleeves and be able to provide an analysis of concrete malicious behaviour.