There is malware uploaded to itch daily. Also , there are hacked accounts seen regularly.
Scammers do fake comments and ratings on occasion.
But in this particular case, it is very unlikely. The account looks trustworthy.
There is of course a tiny chance that the indie developer got hacked and unwittingly uploaded malware. Or that their account was hijaced and something was uploaded. Most hacked accounts I see are user accounts though, but a developer account would be jackpot for any scammer.
The file is small. Upload it to virustotal. But know this, there are many legit games that do get false positives. In particular godot and some renpy games are prone to this. Rpg maker can also have this.
If you decide to trust the people in charge of the account, you need to look into your antivirus software how to whitelist the game. And if you still have some doubts, maybe use some sandbox method for execution. The itch app provides such a mechanism.
But maybe also scroll down in the comments. You are not the first one to get malware warnings and I do not see any statement from the account owner about this.