why are scans saying there is a trojan in this?
Could be hundreds of reasons
Since you can safely assume I write those cracks myself in case they include malicious code there is no way it will be in any antivirus database, 'cause it would be new and have very small target audience
So, if that's not a database hash trigger then it must be literally any other way they check for malware. And the way they usually approach this is basically scan the bytes for some patterns that are likely to be malicious. If you scan .zip archive itself it can quite easily trigger a bunch of stupid antiviruses since the byte[] is somewhat random after the contents are packed, as you can imagine. So if you want more reliable scan you should first unpack the archive and check the .dll and .exe files afterwards.
If you already did that then it's the patterns in those .dlls that might trigger some antivirus AI or smth. I assume that BepInEx files must be already in anitivirus database as non malicious files, so the likely .dlls that could trigger antivirus at this point are 1. My own .dll that does the cracking part
2. winhttp.dll that pretends to be system's dll but is used to hook the process and inject bepinex patcher into the game's process
So you're left with two options. To ensure safety of my own .dll you might as well download DnSpy / ILSpy and reverse engineer it to see what's inside, they don't use any obfuscation and are very small
For the winhttp hook they're using open source dependency uploaded here
You must be registered to see the links
, so you can look at the source code and build it yourself
By the way not triggered antivirus does not guarantee the safety of the program, so for this reason and if the "bepinex files are in AV database" part is not true - the bepinex is also open source and buildable
You must be registered to see the links
Stay safe