Wordfence: WordPress core file modified: [...]

[strarsis]

News, see linked post:

Wordfence plugin and Bedrock

Composer package 4.7.4.1 (notice the .1 extra release level) has been released which files match the checksums and the build process has been improved by johnpbloch to prevent this from happening in future again, see last posts in GitHub issue: