Generally, I do not get involved with discussions regarding this specific package. However, this does seem to be a common theme on VirusTotal regarding installers created with InnoSetup.
See this stack overflow post here:
In the past, we have often suggested that people only install packages from the Dynamo package manager, (which I still suggest for most users and packages).
However, with the way the package manager operates (awfully), I sympathize with Erick on this issue. For him to ensure that his package experience is consistent for users, creating an installer was just about the only option he had.
I have been struggling for months to update Rhythm in a way that allows for use from Revit 2021-2024, and I almost started bundling my own installer as well. (I did manage to get it sorted out on the package manager I think, so we will see).
InnoSetup is a very popular installer creator and is available for free. The fact that we need to put/place files in locations that are deemed “risky”, ie. AppData generally causes flags on sites like VirusTotal. With programs like Revit add-ins and the like, we generally sign the installer, which helps. But, expecting someone to do that () for a free Dynamo plugin is ridiculous.
As @jacob.small said, if you see the results of VirusTotal being alarming to you, take it up with the package author directly. He does not use the forums or the package manager, so creating a post to show the results in a forum he does not visit, doesn’t seem fair.
And to directly address your initial ask of “which version for which Revit”, you would need to make sure you have the correct version for your Revit version. I track these myself here: Dynamo for Revit Version Masterlist - Design Tech Unraveled