just so you're aware, Windows Defender flags the download as malicious
This is very likely a false alarm. Especially when downloading indie games that are made with unfamiliar programs, the Windows Defender and various other Antivirus programs sometimes flag those games, as they don't recognize the file. So while it happens on itch.io, it's more important to look at the creator's page and if they're trustable. That being said, Spicaze is pretty known and authentic, so you could trust them... and although I'm no expert, you can look up false flags on games- itch.io specifically!