Well let me say that it is impossable to get trojan virues on a open sorce project, everyone would have seen it the moment someone tryed to add it. I test out the app on a VM to see if anything happen to it but nothing bad happen: https://app.any.run/tasks/96541bca-b0c4-451d-b2fa-c47c7de5989a
The screenshots you see are what you will see when you going to download the program. What really happen is that your got scam from the company BitDefender and they did not scan the program but instead used this result: https://www.virustotal.com/en/file/63e21381be337f57ca65686df6821c9b27139b8758b31...
This picture is what happens to the program, it shows zero trojan being installed.