[kovidgoyal]

That's a false positive, i.e., a mistaken identification by the antivirus program you use. calibre is an open source program, you can always examine the source code yourself to guarantee the absence of malicous code.