Worldpeace's apparently canceled hack Eggplant had Peach as the villain. It's the only one I can think of.
As for me, I'm not a big fan of non-Marioverse character injection. Give me Bowser any day (though this may have something to do with me having not yet played any hacks with memorable villains other than Bowser).
There was that one time in Mario the Archaeologist in which the intro message was something along the lines of "Bring me treasures or I will kill you", from the princess. Throughout the whole hack, I was hoping to see Peach as a boss. Needless to say, I was disappointed.
As for noteworthy villains, I can't remember the last one I saw (aside from Mario himself, in hacks such as MARIO), if any. I can say that Bowser makes the most appearances by far, and sometimes shows up solely for the purpose of having a boss.
black plague was hilarious for how unfitting he was. does mario seriously need a plot where you get stabbed and sent to hell to fight the devil's greatest minion who is planning on detonating a nuclear bomb to destroy the world?
Dark Mario type bosses are cool in my opinion. Gives you that Dark Megaman feel since it also gets your weapons. If someone could make a Dark Mario that does everything your sprite does from running to shooting bullets to picking up and tossing shells I imagine that'd be the toughest fight
Hunter and SCORPION from The Devious Four Chronicles.
^This pretty much for me also. I do like Zycloboo also just because he's....strange. I usually like when villains are a strange creature. (Or whatever it was it's been awhile since I last played TSRP.)
Pretty much this for me. In general, I really like when allies (like Peach, Toad, etc...) are used as villans in hacks. It's somewhat charming...
I'm also for totally new characters, like Hunter & Scorpion of the Devious Four hacks, Zycloboo, and so on.