I think it's node-webkit's fault. Appending data to the end of an EXE file is a weird thing to do, and I was always a bit suspicious of that approach since I first found node-webkit, so I'm not at all surprised it has ended up throwing false positive virus reports.
I've posted an issue with node-webkit recommending they change this:
github.com/rogerwang/node-webkit/issues/843
Hopefully a future release will simply use a separate data file, which I think will be far less likely to throw a false positive.