Might be worth checking the package to see if the savecore file is definitely in it... I just had a thought... maybe itch.io checks packages?
I'd hope that VisuStella might have fixed it though, it's often just a bad string of characters that happens to crossover with a known virus.