That happened to me too when I went to install it on another rig. Both zip and bin check out clean in Virustotal.

Worst they can do is direct all the hashpower to themselves, which they could do anyway with a binary - no need for a trojan.

But I wouldn't run on a machine you use for anything else until this is cleared up. For a mining rig, again, can't see the harm - I'll notice if extra hash is stolen at the pool and promptly report (as would others) - so I don't see a real incentive for the dev to do anything nefarious.