CloudtheDirewolf that could be false-positive, you can choose not to use the package or inspect the file, it's up to you.
NB: as result of data, both microsoft anti-virus and google download check system are commonly report file as virus, even they are not.
the trick is scan each file in package with anti-virus software to know which file is wrong.