# sweetalert2 hidden functionality and protestware

Source: https://junglewise.ai/threats/sweetalert2-hidden-functionality-and-protestware-03d50cb7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2022-11-23

sweetalert2 is a popular JavaScript library that provides customizable popup alert boxes. Versions 8.19.1 through 11.22.3 contained undisclosed audio and video messages unrelated to the library's core functionality, added by the maintainer. This unexpected behavior could confuse users and damage trust in applications using the library.

Technologies: [sweetalert2 (npm)](https://junglewise.ai/threats/technologies/sweetalert2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 23 November 2022.

**Which products and versions are affected?** sweetalert2 (npm) SEMVER:introduced=8.19.1,fixed=11.22.4.

**Is there a fix for This vulnerability?** Yes. sweetalert2 (npm): upgrade to 11.22.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run sweetalert2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sweetalert2 (npm): upgrade to 11.22.4 or later

  ```sh
  npm install sweetalert2@11.22.4
  ```


## Technical details

The vulnerability is classified as hidden/protestware functionality (CWE-912). Between versions 8.19.1 and 11.22.3, the sweetalert2 npm package contained embedded audio and video content that served no purpose related to the library's alert box functionality. This code was injected into the package by the maintainer without disclosure in release notes or documentation. The malicious code executes automatically when the library loads in any application using affected versions. The issue was resolved in version 11.22.4 (released August 2025), which removed the protestware code.

## Affected products

- sweetalert2 sweetalert2 8.19.1 through 11.22.3

## Timeline

- 2022-11-23: disclosed
- 2025-08-14: patched: Version 11.22.4 removed the protestware functionality

## References

- [https://github.com/sweetalert2/sweetalert2](https://github.com/sweetalert2/sweetalert2)
- [https://github.com/sweetalert2/sweetalert2/releases/tag/v11.22.4](https://github.com/sweetalert2/sweetalert2/releases/tag/v11.22.4)

## Related threats

- [sweetalert2 undesirable behavior on specific TLDs](https://junglewise.ai/threats/sweetalert2-undesirable-behavior-on-specific-tlds-fd4b5ac4)
- [sweetalert2 hidden functionality in versions 9.17.4 through 10.0.0](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-versions-9-17-4-through-10-0-0-c94c7cec)
- [sweetalert2 hidden functionality in alert dialogs](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-alert-dialogs-5fc44f4d)
- [sweetalert2 hidden functionality in package initialization](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-package-initialization-f7a140e3)