Virustotal uses a lot of tools to check for viruses. While it is good for checking general safety of the game, it is not 100% reliable (Especially for indie games, it shows a false positive when the game's not been digitally certified).
The game's file's are in github (not just opensource), and I can assure you that it's been built from scratch including bgms. But still, I'll check the game again, thanks for the report.