
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@magictm/strapi-plugin-deep-populate
Advanced tools
🚀 The MagicTM Deep Populate Strapi Plugin simplifies deep population of content structures within your Strapi v4 applications. This plugin streamlines fetching nested data, making your API responses more comprehensive and developer-friendly.
🌐 Follow me: https://stawowczyk.me
Strapi v4 - (current) - v1.x
Tested on Strapi v4.25.4.
This plugin is an extension of https://github.com/Barelydead/strapi-plugin-populate-deep created by @Barelydead. Due to the lack of development of the plugin, I decided to extend the plugin with some features I need and share it with the community.
npm install @magictm/strapi-plugin-deep-populate
Navigate to your Strapi project's configuration file:
<strapi app root>/config/plugins.js or .ts
Add the following code snippet:
'magictm-deep-populate': {
enabled: true,
}
'magictm-deep-populate': {
enabled: true,
config: {
minDepth: 5, // Minimum population depth
maxDepth: 5, // Maximum population depth
// Skip populating creator fields (e.g., created_by)
skipCreatorFields: false,
// Array of fields to always ignore.
// Must be type of ['relation', 'component', 'dynamiczone', 'media']
ignore: ['localizations', 'strapi_stage'],
// Enable debug mode for detailed logs
debug: false,
// Array of models where deep population is allowed e.g. ['api::page.page', 'api::post.post']
// If empty all models are allowed.
allowedModels: ['api::page.page', 'api::post.post'],
},
}
export default () => ({
// other plugins
'magictm-deep-populate': {
enabled: true,
},
})
For the changes to take effect, restart your Strapi application:
npm run develop
The MagicTM Deep Populate plugin seamlessly integrates with your existing Strapi API. Here's how to use it:
To fetch content with deep population up to the configured default depth, simply append ?populate=deep to your API endpoint:
/api/articles?populate=deep
For finer control, specify the desired depth level numerically after the deep keyword:
/api/articles?populate=deep,10
This fetches articles with relations populated up to 10 levels deep, or the maximum depth set in the plugin configuration – whichever is lower. This ensures your API responses remain performant even with large datasets.
Please note! Using
?populate=deep,1with depth of 1 will always return all relations with depth 1. Works same as?populate=*.populateIgnorewill as well not work.
Use the populateIgnore parameter to prevent specific fields or relations from being populated. This helps tailor your API responses by omitting unnecessary data.
For example, to exclude the seo field from population:
/api/articles?populate=deep&populateIgnore=seo
You can comma-separate multiple fields to ignore. For instance, to exclude both the seo field and a relation named relPosts:
/api/articles?populate=deep&populateIgnore=seo,relPosts
Contributions to the MagicTM Deep Populate Strapi Plugin are always welcome! To contribute:
master branch.If you find this plugin valuable, consider supporting its development. Your contribution helps me maintain and improve this project.
We appreciate all sponsors! Please contact us if you're interested in sponsoring this project.
MIT License © 2024-PRESENT Marcin Stawowczyk (m7rlin)
Thank you for using the MagicTM Deep Populate Strapi Plugin! Let me know if you have any other questions.
FAQs
Adds better deep populate support for Strapi.
We found that @magictm/strapi-plugin-deep-populate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.