Mahou,
I took a closer look at the package because of your comment and did a static analysis of both the Unity package itself and the installer currently served by its API.

I couldn't find any token stealer, malware payload, suspicious DLL/EXE, PowerShell execution, browser/Discord credential access, or other obviously malicious behavior in the version that's currently being distributed.

What I *did* find is that the Okaeri installer has a self-updater that downloads C# code from their server and replaces the local installer script with it. It also downloads configuration data from the same server. That's probably one of the things that can make AV/heuristic protection unhappy.

The current code being served looked clean when I checked it, but the updater design does create a supply-chain risk: whoever controls or compromises that server could theoretically change what code Unity receives later.

So I wouldn't call the current package malware based on what I found, but I also wouldn't blindly whitelist it. If you use it, I'd recommend using something like FACS Safe Import, doing the setup, and then removing the Okaeri installer/editor scripts afterward.

Got several 'phishing attempts detected' from my av while trying to install this, so I'd probably pass on this.