Viruses often masquerade themselves as installers (or embed themselves into standard installer executables or msi’s, like the NSIS installer that Notepad++ uses). So sometimes virus scanners associate the “signature” of normal/safe code of an NSIS installer as part of that virus, which then means the antivirus will flag any NSIS-based installer, like Notepad++. Usually they get enough complaints of false-positives that they fix their definitions pretty quickly. But it doesn’t always happen.

(Either that, or you didn’t download the Notepad++ from an official source – either from the “announcements” thread in this forum, directly from https://notepad-plus-plus.org/downloads/, or from https://github.com/notepad-plus-plus/notepad-plus-plus/ . Anyplace else is not supported and not guaranteed or warranteed.)