The malicious software warning is harmless.
Windows marks anything downloaded from the internet that is not 'signed' as malicious.
I spent some time a few years ago trying to get set up to sign our builds, but was unable to get through the process and bureaucracy. Microsoft uses outside companies to do the signing -- they ensure you are 'trusted' by charging an exorbitant fee to sign binaries. As an open source project, we can't afford to buy the trust. There are some provisions for open source projects -- but they don't build trust in a project, they build trust in a single download. Consequently, every time a new build is released, the first X downloaders would see it as untrusted -- if enough of them trust it, it would then become trusted for later people. I tried going down the path of figuring this out and integrating it into our build system, but I was unable to get it all sorted.
We use an external library to perform constrained Delaunay triangulation. This is notoriously tricky to get 100% robust. A couple years ago, I switched from library A to library B in an attempt to improve things. Unfortunately, it seemed to be causing more problems than it fixed. In 3.43.1, I switched back to library A. I suspect this switch is causing the problems you're seeing.
Thanks for sharing your file, I will try to use it to replicate the problem.
Rob