itch.io

As a solution he should publish his game hash and make sure that everyone has access to it, if u download eternum then hash it, and the hash is different than the one provided by him means the download is corrupted.

Certainly, i tested his version though, the problem here is that some of the libraries, code templates or assets that he uses are also used in some malware, he should check that, i believe getting a score of 0 flags is important and even more important due to the fact that's top shelf. A score of 0 doesn't mean its safe but getting flagged while being one of the most popular its also not a good thing. As a bonus piece of intel: is extremely easy to by pass a signature based antivirus, if i take his game, add a comment in the first line writing the letter "a" the hash is complety different (signature based antivirus compare hashes with a huge database of virus hashes and if it matches then its a corrupted file). Behaviour based antiviruses are other thing but they are kinda hard to deal with (called Next gen antiviruses). Final thoughts, the file is most likely clean, but use sandboxie at least, its free and your data is very important, I personally use an air gapped old pc, air gapped means not connected to the internet.

The .EXE file named eternum-32.exe is tagged by an antivirus as malware, has multiple malware parents (hacked version of this game distributed online) and contacts malicious ips (tested in a sandbox enviorment by virus total tool).

Virustotal info:

https://www.virustotal.com/graph/62cb04500df8dcec7c13526799e0326108a9b54b9cbd1ff...

EDIT:

Tested it more thoroughly, multiple files get flagged by 2 antivirus providers, usually when u get 1/2 flags its a FP, still it shouldnt get any. Run this kind of games sanboxed, in a virtual machine or in an air gapped machine. 

EDIT2:

I also sanboxed it and seems fine so most likely a False positive, still i dont recommend running on the main machine, run only 0/0 scores and sandboxed with tools like sandboxie, malware can be tricky to catch specially with signature based software.