I had the game downloaded from months ago but haven't opened the itch.io client for a few weeks. So it was an update between today and around the middle of May. If it installed multiple patches on top of each other that could have triggered a false positive, so I'll reinstall and see what happens.
Running a windows defender scan didn't flag it this time, so it was probably an issue of a backlogged patch being installed before the more current one.