Hey there, thanks for checking and bringing it up.
To clear up any confusion, this is a 100% false positive caused by how the executable is packaged.
Here is exactly what is happening:
- Embedded PCK: The game’s assets and scripts are embedded directly inside the
.exerather than shipped as a loose secondary file. When an executable contains over 100 MB of internal data appended to its binary structure, heuristic scanners often flag it as "obfuscated" by default. - Enigma Protector: On top of that, an anti-reverse-engineering layer (Enigma) was applied to the binary to prevent datamining. Security software hates protectors and packers because malware authors sometimes use similar packaging techniques. This approach will no longer be used.
- All 4 flags are Machine Learning heuristics: If you inspect the VirusTotal report, 64 out of 68 vendors report it completely clean. The only 4 detections (Microsoft Sabsik...!ml, Trapmine .ml, Gridinsoft Heur!) are automated Machine Learning and heuristic guesses. There is no actual virus or trojan in the file.
There is really no reason to be alarmed. That said, if you still feel uncomfortable downloading or running the .exe on your machine, you don't have to download anything - the game is fully playable right here on itch.io in your browser via the Web version, which runs inside a completely isolated WebAssembly sandbox.
I'm already working on packaging future builds differently (separating the PCK file and tweaking protection) to eliminate these false positive alerts for good.
Hope this clarifies things!