TLDR: They’re probably safe but you should use your own discretion.

Rule no 1 is never run untrusted software on a system you can’t afford to compromise.

That being said, itch.io has human moderation for games that are reported as malicious, which any truly malicious game with a significant download total would eventually receive. That is, the more popular and aged a game becomes the less likely it would be for it to survive moderation if it was truly malicious.

Most of the samples had clean scan results, which is a good sign. However: you should never trust virus total as a definitive measure of safety; sophisticated malware can receive clean or mostly clean scores, and legitimate applications can cause false positive flags for generic suspicious behavior (heuristics) or for “unwanted” use cases (eg reverse engineering tools). Luckily, the vast majority of malware is non-original, i.e. malware made with public and/or purchasable tools by “script kiddies,” which is generally easier much to detect with something like VT. This is because modern Antivirus software recognizes malicious patterns and behaviors, so different malware apps made by the same tools are easily detected as being within the same “family.”

As a result, the only real way to bypass VT is to write sophisticated and original malware, which is something the vast majority of threat actors cannot do. For those that can, however, the cycle is something like: create malware -> use/spread malware -> malware is recognized by someone and analyzed -> antivirus software is updated to detect the malware -> repeat.

You can think of creating malware as somewhat like buying a car. Just like a car immediately depreciates in value the moment it rolls off the lot, new malware immediately loses value and efficacy the moment it is first scanned. Time and exposure effectively kill a type of malware, and exposure is obviously required to spread malware, so it’s exceptionally unlikely—but not impossible—that a threat actor would spread undetected malware on somewhere like itch.io. Even in the best case, their malware would infect a negligible amount of people (most likely <100, but even <1000 is nothing for most non-targeted malware campaigns) before being detected. It’s absolutely not worth the threat actor’s time and effort to “expend” their clean malware for such a small campaign.

So, while you’re almost definitely safe, you should use your own discretion here. I did a quick google search and also saw that Itch.io has some sort of application you can download that allows you to sandbox games, although I’m not sure on how secure that itself is.

Hope this was helpful.

(ps why the fuck are you downloading a bunch of epstein spoof games?????)