Oh and also, thanks for the link, I didn't know about that tool. I'd tend to think it's a false positive... see here for a VirusTotal check on it. Three out of the 72 scanners see it as malicious, I'd think it'd be a lot more if it were real. I'll ask the team responsible for it anyway, if it indeed...

I completely agree, it's most likely a false positive. But the risk of being wrong is too high, considering the threat level and what this malware does. So until Espressif confirms that it's a false positive, and upload a version that doesn't trigger it, I'm not ready to take the risk.

Same here. Because of the threat level, I'm not comfortable assuming it's a false positive. Unfortunately Espressif doesn't give us the checksum so we can't verify independently if it's safe. Hopefully we'll get an answer soon.