velocityfix@1.0.0

Analysis

Package 'velocityfix' typosquats the Minecraft Velocity proxy. Its postinstall script (scripts/loader.js) downloads a native executable from store6[.]gofile[.]io/download/web/bcd38d7d-1647-4448-a448-037d58ad9413/payload.exe, saves it to the system temp directory, launches it silently in the background with `start /b`, then deletes the executable after 5 seconds. The package also bundles a copy of the same executable (payload.exe, 1.7 MB) as a fallback. The gofile[.]io host is the external payload source.