I posted the solution - ignore it.
Edit: In the interest of self-help, that sounds arrogant of me, and I apologize. What I should have said was this is likely a false positive. The devs will most certainly be checking into this, and if it were serious it would have been replaced. It is basically a catch-all virus notice, more like a warning, that there is some javascript that appears to be from an untrustworthy source.