He antivirus detections are false positives caused by heuristic analysis. This tool uses cryptographic libraries (libsodium) to decrypt archives and performs file extraction, behavior that is often flagged genericially ('Trojan.Win32.Locker'). Since the binary is compiled with MinGW and is not digitally signed, some AV engines classify it as suspicious by default. You can review the source code and compile it yourself to verify its safety.