False-positive virus scanner results for APE executables are normal. Cosmopolitan is a weird hack that bends a lot of rules to work at all, but it does make cross-platform support of POSIX CLI apps very convenient.
Be informed, and use at your own risk. Feel free to review the implementation and build it yourself if you're uncomfortable with the provided binary: https://github.com/JohnEarnest/Decker
