Edit: I might be close to paranoid but I've seen to many cases of nice freeware or open source software getting compromised or even selling out to adware.
Seems like a false positive, Windows Defender stopped reporting it as infected after definitions update. sha256 of the file in question is f7540af3ad4aa7e6f02c850bfe428d65e481f8b4c00c2927f72b62450f4ec42b .
Edit: I might be close to paranoid but I've seen to many cases of nice freeware or open source software getting compromised or even selling out to adware.