There's nothing malwareish about the source and binaries package I downloaded, nor about the version from Arch AUR I'm actually running. Your Brave may be objecting to the absense of https. Mine only states the obvious "Not secure" in the address bar.