relative-time-live@0.1.0

Analysis

This package presents itself as a self-updating relative-time formatting utility with optional React/Vue bindings, and its visible code does implement that functionality cleanly. However, its published code unconditionally side-effect-imports a hard dependency (dom-weave) at module load, and that dependency in turn dynamically loads a further package (sync-logger). The deepest package masquerades as a logging utility but, on import, decodes a large embedded base64 blob by XOR-ing it against a fixed 16-byte key and immediately executes the decoded result as code via the Function constructor, all wrapped in an error-swallowing try/catch to stay silent on failure. The net effect is that merely installing or importing this relative-time package causes hidden, obfuscated code to run on the host through a multi-tier dependency chain whose lower tiers look innocuous in isolation. This staged structure (appealing top-level utility -> innocuous middle helper -> obfuscated self-executing payload leaf) is characteristic of a deliberate supply-chain dropper.