I really wonder, how, as a unaware user do you know which dev is legit and which isn't.
Thanks for posting.
I was watching a recent video from Gameranx and in it, Steam seemed to have the problem that some non commited devs were installing malware via update. So you downloaded a legit game that didn't had malware but with the update you got it. For free.
It makes me wonder how i can be aware of these things as i do enjoy games from unknown people like on itch.
Unfortunately, at least I have no definite answer for that. It is always risky to download anything into your computer... However, while using Itch.io, and more precisely the Itch.io App, you can unable itch.io sandbox (Preferences --> Security & privacy) and while it is not perfect and does not actually prevent you from downloading malware, it does at least attempt to minimize the potential harm they can cause.
If someone smarter has a better solution, I'm all ears.