The project is open source -- you can literally go look at the code in GitHub. Y'all out here with pitchforks demanding a statement but this sort of false positive is super common with installers/bundlers because of the way they work. If you're worried about it, go download the source code and run it with a clean install of Python, instead of using the bundled version. I've done work in the codebase on my own fork to add some experimental features, and I can definitely say the code itself has nothing malicious in it.
It's a good thing to be paranoid these days, but the tools are right in front of you to just run it from the source code yourself if you don't trust the binaries you're provided. Also, the dev literally already told you all of this earlier in the thread.
[You must be logged in to view images. Log in or Register.]