Is It Dead Yet?
sweetalert2npm
- latest 11.26.25
- licence MIT
- stars 18,104
- checked yesterday
- registry ↗
- repository ↗
Signals · last 1 check
State history 1
| When | Change |
|---|---|
| 2026-09-03 | first verdict: active |
Supply-chain history 1
-
protestware shipped 2022-03 11.6.14 and every later release
The maintainer ships code that, for Russian-language browsers on .ru, .su, .by and .рф domains, blocks mouse interaction and plays the Ukrainian anthem — disclosed on the package’s own npm page.
Still shipping; in July 2025 Socket traced the payload copied without disclosure into 28 other packages.
Source: Socket analysis, 15 July 2025. History, not a warning about today — the verdict above is about maintenance now.
Badge
Drop this in your README. It re-renders itself as the verdict changes.
[](https://isitdeadyet.dev/npm/sweetalert2)Watch it
Get told when sweetalert2 changes state, changes licence, or is deprecated — instead of finding out during an incident.
Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.