While launching the game with the latest windows 11 insider preview, this mod and clientcommands were both flagged as containing the trojan "Trojan:Script/Wacatac.B!ml", probably a false positive but we never know

A similar issue was posted by myself on https://github.com/Earthcomputer/clientcommands

Microsoft defender is just stupid and sometimes does that to java files. It's not a trojan as verified by curseforge and modrinth, and even by yourself reading the source code right here if you want.

Yes, if you downloaded the mod from either Curseforge or Modrinth, they basically guarantee it to be safe. This is most likely a false positive from your viris scanner, which does happen sometimes.