Malware must also have some source code ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

For fun, try compiling it yourself and see what scan results you get?

Its supposedly open source??

NPM users: “…and?”

Look like those are some sort of cheats? and cheats often work just like a virus would and therefore get flagged as potentially harmful. So it’s not really surprising at all.

However, I can’t confirm whether these particular ones are just false flagged or have actual malware.

Just like with any pirated apps and games, use cheats at your own risk.

Hopefully somebody with more time and less dignity combs through the github and tells you what all is problematic about it.