I agree that this is probably something we should outright ban. We really haven't had an issue with this being a problem though, so I'm going to hold off updating our rules for the time being. Generally virus scanners do detect them which causes the projects to get flagged anyway.
Please reconsider that stance; a very clear 'no malware' rule needs to be put in place, including ATTEMPTS at POTENTIAL malware-like activity. For a recent example, please reference current events regarding Epic Games Store launcher using malware-like activity to illegally-access & weak-encrypt information from Steam friendslist in a pathetic attempt to acquire information without explicit permission.
In addition any developer that does this AT ALL (whether later-removed or not) needs to be permanently banned from the itch.io store with prejudice. I understand that itch.io is currently dev-focused, however in the case of malware and/or malware-like activity, there should be no tolerance of such on the itch.io platform.
I'd love to promote itch.io more as a legitimate storefront if such basic consumer-protections were put in place. An 'unconditional' refund system equal to or better than the Steam Refund System (2 hours or 14 days, whichever comes first) would also be nice.
The projects should not just be flagged, they should be auto-removed.
The 'developers' of the projects should also be flagged & a perma-ban should be issued if they are found to have violated the anti-malware rules. If a developer has a legitimate concern then they should bring it up PRIOR to uploading. For example, I personally developed & submitted (on the Nexus Mods website) a self-created utility for a video game that was created utilizing the 'trainer' EXE creation functionality of Cheat Engine (an open source program). I manually requested a whitelisting and explained how the utility was made and why it was being flagged. After review, my request was manually approved and the entire process was done with little fuss.
If a website for mods can manage a certain level of professionalism, then I'm certain that my expectation for the itch.io platform is to do far better than that!