Chocolatey requires scans on _most_ uploads to the service. Under a certain threshold it only gives you a warning that says "this package had x detections".

Here's FAR manager which for some reason has some hits on virustotal

https://community.chocolatey.org/packages/Far