Look for credible Devs who are responsive to messages etc. Look for genuine and authentic projects. Lots of screenshots and in depth descriptions. System requirements listed is also a plus. Check how long they have been active and how many followers they have. Also if you read this follow me in authentic haha.
Stay safe out there everyone.
Unfortunately you can't recognise a genuine project by description and screenshots, because the malware projects often copy those 1:1 from an original project. Sometimes even from the Itch page of the original project. I have seen fake and original both appear in search.
Account age is overcome by using hacked accounts. That got a little better compared to last year. But I did see hundreds of hacked accounts last year.
I saw a bot army doing fake comments. I saw scam accounts with over 40 followers doing links to malware as a blog posting.
I saw criminals answering comments. It is rare, but it happened.
I saw fake projects with good ratings. They are not distinguishable from new projects that also have no or few ratings.
I saw malware with faked exe signing and malware that did not trigger virustotal scanners. (And a lot of legit projects that do have false positives).
I saw malware here that was two years out in the open.
So, yes, stay safe everyone. Look for genuine and authentic projects. But unfortunately, there is no single thing that will make a project such. If there were, the criminals would fake that.
Using a sandbox mode to execute untrusted software protects against some malware. It should not be able to steal your credentials that way. The Itch app provides such a sandbox mode.
