itch.io

The way you mention vaporware and ransomware together with malware as an extra does not make me think you talk about the same things as I do. It is like saying you bought bananas, apples AND fruit. 

Ransomware, worms, trojans are types of malware. Mal-ware is mal-icious soft-ware. It does harm. A virus scanner would detect it, if the scanner is good. Depending on the harm even a heuristic should detect it.

Vaporware is not malware. It is announced, but unreleased software. A "classical" example would be a kickstarter software project that does not deliver. If this is intentional, it is a scam. If it is just a long time, it is fans complaining. Duke Nukem Forever and Cyberpunk 2077 were both vaporware - till they eventually did get released.

There is no dispute over malware being spread on Itch. Read the public service announcment by leafo. Wanna call the people in that thread liars too, just because you did not see it happen personally...

My point and reason for this thread is, that direct messages on discord with a link to a password protected "game" are not the only method the criminals use to distribute malware. They upload malware as a regular game and wait for unsuspecting players, that never saw viruses on Itch and are trusting and happy to have found a shiny new game.