As the developer of itch & itch-setup, I also confirm this is a false positive. We've gotten 3 reports of that particular false positive in the past two days, but nothing has changed on our side (our servers are still serving the same executable, which is built on our servers, signed with our code certificate, from open-source code).
We hope AV vendors will take action quickly to squash that false positive, as we don't want our users to be worried for nothing!