The problem of someone else's popup appearing

Yes definitely, it must have been compromised to execute a supply chain attack. Good lesson to ourselves and others not to use @latest when loading external libraries. Loading from version 2.0.4 solved it for us