I've installed the Doppler CLI on my Windows machine using Scoop and recently updated it using Scoop to v3.38.0. When I tried to run doppler setup, Norton blocked the executable from accessing network resources.

I initially thought it was a false positive and allowed it, but have since done a bit more investigating. I used certutil to checksum the blocked executable (found at c:\Users\<USER>\scoop\apps\doppler\3.38.0\doppler.exe ) and discovered the sha256 hash differs from the hash in the doppler.json file of this repo:
Hash in the doppler.json of this repo:
594c747c8d6d7c41ecc0e92adfa33253976bd0126f18f358512c19d66f577a6e
Hash I found using certutil:
58f917c9c352141199ee0ab026f2003f3adbf9fe73e8e21c0cc296f1b6030c27

I'm unsure if this is significant as I don't know if the hash in the package's .json file is meant for checksums like this. I also uploaded the executable found at that path above to Intezer and VirusTotal and both flagged it as malicious. Am I right to be suspicious?