Whatever is giving you the above report is throwing a false positive there.
That .VERSION file contains nothing more than a string holding the version number, such as 5.0.4.031.
I’ll open a ticket to make sure that is removed from future releases as it’s not needed, but there is nothing malicious about that file. In the meantime, you are free to remove it from your site if you prefer.