# sweetalert2 hidden functionality in package initialization

Source: https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-package-initialization-f7a140e3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2022-11-23

sweetalert2 is a popular JavaScript library that provides polished popup dialogs and alerts for web applications. Versions 11.4.9 and above contain hidden code that plays unsolicited audio or video messages unrelated to the library's intended functionality, potentially degrading the user experience and raising concerns about supply chain integrity and maintainer intentions.

Technologies: [sweetalert2 (npm)](https://junglewise.ai/threats/technologies/sweetalert2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 23 November 2022.

**Which products and versions are affected?** sweetalert2 (npm) 11.4.9 to 11.22.3.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run sweetalert2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

sweetalert2 versions 11.4.9 and above contain hidden initialization code that outputs audio and/or video messages not documented in the library's API or release notes. The code was intentionally introduced by the maintainer and was absent in versions 11.0.0 through 11.4.8. The hidden functionality executes during normal package loading without explicit developer consent or awareness. While not a traditional security vulnerability that enables unauthorized access, this behavior violates user expectations and library transparency. The vulnerability was resolved in version 11.22.4.

## Affected products

- npm sweetalert2 11.4.9 to 11.22.3

## Timeline

- 2022-11-23: disclosed

## References

- [https://github.com/sweetalert2/sweetalert2](https://github.com/sweetalert2/sweetalert2)
- [https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9](https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9)

## Related threats

- [sweetalert2 undesirable behavior on specific TLDs](https://junglewise.ai/threats/sweetalert2-undesirable-behavior-on-specific-tlds-fd4b5ac4)
- [sweetalert2 hidden functionality and protestware](https://junglewise.ai/threats/sweetalert2-hidden-functionality-and-protestware-03d50cb7)
- [sweetalert2 hidden functionality in versions 9.17.4 through 10.0.0](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-versions-9-17-4-through-10-0-0-c94c7cec)
- [sweetalert2 hidden functionality in alert dialogs](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-alert-dialogs-5fc44f4d)