
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Firetype is a lightweight wrapper around the Firestore SDK that adds type safety and schema validation to your Firestore database operations in TypeScript. It extends the existing Firestore SDK functionality while maintaining all its native features and requiring the original SDK to be installed.
firebase-admin and firebase/firestore SDKs⚠️ Note: Firetype extends the Firestore SDK and is not a replacement. You'll still need to install and use either
firebase-adminorfirebase/firestoreas your primary SDK.
npm install firetype
# or
yarn add firetype
mkdir -p firetype/database
firetype/database/users/schema.ts):import { z } from "zod"
export const schema = z.object({
name: z.string(),
age: z.number(),
email: z.string().email(),
createdAt: z.date(),
})
yarn firetype generate --input=./firetype/database --output=./firetype
or
npx firetype generate --input=./firetype/database --output=./firetype
// Admin SDK usage
import { createFireTypeAdmin } from "./firetype/firetype"
import { getFirestore } from "firebase-admin/firestore"
const db = getFirestore()
const firetype = createFireTypeAdmin(db)
// Type-safe operations
const user = await firetype.users.getCollection()
const allUsers = await user.get()
// Client SDK usage
import { createFireTypeClient } from "./firetype/firetype"
import { getFirestore, getDoc } from "firebase/firestore"
const db = getFirestore()
const firetype = createFireTypeClient(db)
// Type-safe operations
const userRef = firetype.users.getDocumentRef("user123")
const snapshot = await getDoc(userRef)
# Generate types for both admin and client (input and output are REQUIRED)
firetype generate --input=./firetype --output=./firetype
# Generate types only for admin SDK
firetype generate --mode=admin --input=./firetype --output=./firetype
# Generate types only for client SDK
firetype generate --mode=client --input=./firetype --output=./firetype
# Specify different input and output directories
firetype generate --input=./src/schemas --output=./src/types
# Show help
firetype help
Note: Both
--inputand--outputparameters are required when using the generate command. The input parameter should point to the directory containing your schema definitions, and the output parameter specifies where the generated TypeScript file will be placed.
Firetype uses Zod schemas to define your collection structure. Here's how to organize your schemas:
// firetype/users/schema.ts
import { z } from "zod"
export const schema = z.object({
name: z.string(),
email: z.string().email(),
metadata: z.object({
lastLogin: z.date().optional(),
isVerified: z.boolean(),
}),
})
// firetype/users/posts/schema.ts
export const schema = z.object({
title: z.string(),
content: z.string(),
publishedAt: z.date(),
tags: z.array(z.string()),
})
// firetype/users/settings/schema.ts
export const schema = z.object({
theme: z.enum(["light", "dark"]),
notifications: z.boolean(),
preferences: z.record(z.string()),
})
firetype directoryfiretype generate before building your applicationgit checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)MIT
If you find a bug or want to request a new feature, please open an issue on GitHub.
Made with ❤️ by the Firetype team
FAQs
Typesafe ODM for Firestore
We found that firetype demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.