You could have malware in any type of file format. If there are bugs in the program that reads it, then even text files can be infected. Some recentish OSX version had a bug where any file could be infected by manipulating it’s meta data. It used file sharing software to spread malware and could be attached to executables, images, movies, mp3, etc. Chrome once had a bug where a person could stick java script somewhere in their html file that could be executed even if read in the view source window, which is supposed to be what is basically just a read-only text editor with syntax highlighting.
(The feature that gives that warning, available in Chrome and the default Firefox setup, also fits my definition of malware, by the way. As do most virus scanners. They are all functionally equivalent to spyware.)
The image that links to freeimagehost.net is actually Delinitor’s profile picture.