As title says, gave me quite the scare.

This is the latest version I got from Modrinth

I'm assuming this is just a false positive, but probably worth looking into.

If you're not aware of this yet, might be worth a read: https://github.com/fractureiser-investigation/fractureiser

TLDR: a very dangerous virus has recently been found spreading through minecraft mods, infecting other jars on the system and stealing credentials.

This is a false positive - Indium is not infected with the fractureiser virus or any other, and as far as I know Windows Defender is not able to detect fractureiser yet.