The script is on Mudcat, but that doesn't necessarily mean it's been hacked. Google asks you to install analytics scripts on your own web site if you advertise on Google ("sponsored" search results) so you get feedback about who's responded to your adverts, and evidently (as in Mudcat's case) also if you display adverts, to feed back info to the advertisers.

But as Kaspersky's flagging it, I thought I'd better ask before assuming it's a false positive and blindly accepting it.

I appreciate that Max has to meet his expenses somehow, but if there was a sensibly priced tracking-free/ad-free option for Mudcat, I think I'd subscribe to keep all that cutter out.