
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
multer-firebase-sharp
Advanced tools
Multer Storage Engine for Firebase Storage along with integration with npm sharp library for image manipulation before upload
Multer Storage Engine for Firebase With npm sharp integration for image processing
npm install multer-firebase-storage-sharp
Using Express:
const Express = require('express')
const Multer = require('multer')
const FirebaseStorage = require('multer-firebase-storage-sharp')
const app = new Express()
const multer = Multer({
storage: FirebaseStorage({
bucketName: 'your-default-bucket',
credentials: {
clientEmail: 'your-firebase-client-email',
privateKey: 'your private key',
projectId: 'your-project-id'
}
})
})
app.post('/file', multer.single('file'), (req, res) => {
res.status(201).json(req.file)
})
app.listen(3000, () => {
console.log('Example app listening on port 3000!')
})
Firebase Storage supports the following setup options:
{
bucketName: string;
credentials: string | { projectId: string, privateKey: string, clientEmail: string }
directoryPath?: string
mimeMap?: {
[fileName: string]: string
}
appName?: string
namePrefix?: string
nameSuffix?: string
unique?: boolean
public?: boolean
hooks: {
[hookName: string]: function
}
sharpPipeline: sharp.Sharp || null
}
bucketName
: The name of the bucket to upload to.credentials
: The credentials to use for authentication. It can be a refresh token string or the Firebase credentials object (just like the firebase admin SDK requests).
projectId
, privateKey
, clientEmail
which can be obtained by the Firebase console.privateKey
field needs to be in the same format as in the JSON file.directoryPath
: Will be prepended to the file name to include the file in a subdirectory.
image.jpg
and the directory path is images
, the resulting file name will be images/image.jpg
. There's no need to add a trailing slash.appName
: Firebase allows only a single instance of its admin SDK to be executed per app. If you need more than one, specify the name of the app you want to use. Remember it needs to be unique in the application
namePrefix
: The prefix to be added to the file name.
image.jpg
and the prefix is preview_
, the resulting file name will be preview_image.jpg
.nameSuffix
: The suffix to be added to the file name.
image.jpg
and the suffix is _final
, the resulting file name will be image_final.jpg
.unique
: If set to true
, the file name will be unique by generating a time-based hash that will be appended to the end of the file name (after nameSuffix
and before the file extension). If set to false
, the file name will be the same as the original file name.
image.jpg
and the suffix is _final
and unique
is true
, the resulting file name will be image_final<somehashhere>.jpg
.public
: If set to true
, the file will be made public and the public URL will be returned. If set to false
, the file will be private.
hooks
: Where you can define lifecycle hooks
sharpPipeline
: When using this storage engine for images, you can create a full image processing pipeline using the npm sharp library before the actual file gets uploaded to firebase. Usage Eg.
After a successful insertion, all returned data will be appended to the req.file
object. Besides the original Multer properties, the following properties will be added:
fileRef
: A reference to the Firebase Storage file object. You can use that to manipulate the file after the upload has been done.
firebase.storage().bucket().file(filename)
path
: The path of the file in the bucket.bucket
: The name of the bucket.bucketRef
: A reference to the Firebase Storage bucket object. You can use that to manipulate the bucket after the upload has been done.
firebase.storage().bucket(bucketname)
isPublic
: If the file is public or private.publicUrl
: If the file is public, the public URL will be returned.You can pass an optional parameter to the FirebaseStorage
constructor to use your own Firebase instance. In this case, the credentials
and bucket
options will be ignored.
const Express = require('express')
const Multer = require('multer')
const fbAdmin = require('firebase-admin')
const FirebaseStorage = require('multer-firebase-storage-sharp')
const app = new Express()
const fbInstance = fbAdmin.initializeApp({
credential: fbAdmin.credential.cert(somecredentials),
storageBucket: 'some bucket'
})
const multer = Multer({
storage: FirebaseStorage({}, fbInstance)
})
app.post('/file', multer.single('file'), (req, res) => {
res.status(201).json(req.file)
})
app.listen(3000, () => {
console.log('Example app listening on port 3000!')
})
Multer-Firebase-Storage supports the following lifecycle hooks:
beforeUpload
: This hook will be called before the file is uploaded to Firebase Storage.afterUpload
: This hook will be called after the file is uploaded to Firebase Storage.beforeDelete
: This hook will be called before the file is deleted from Firebase Storage.afterDelete
: This hook will be called after the file is deleted from Firebase Storage.beforeInit
: This hook will be called before the Firebase Storage instance is initialized.afterInit
: This hook will be called after the Firebase Storage instance is initialized.Each hook has a different function signature:
beforeUpload
: (req, file) => void
req
is the Express request object. file
is the Multer file object.afterUpload
: (req, file, fileRef, bucketRef) => void
req
is the Express request object. file
is the Multer file object. fileRef
and bucketRef
are the references to the Firebase Storage objects.beforeDelete
: (req, file) => void
req
is the Express request object. file
is the Multer file object.afterDelete
: (req, file, fileRef, bucketRef) => void
req
is the Express request object. file
is the Multer file object. fileRef
and bucketRef
are the references to the Firebase Storage objects.beforeInit
: (storageInstance) => void
storageInstance
is the Firebase Storage instance passed as this
.afterInit
: (storageInstance, firebaseInstance) => void
storageInstance
is the Firebase Storage instance passed as this
. firebaseInstance
is the Firebase instance passed either as the second parameter to the FirebaseStorage
constructor or the internally constructed instance.const Express = require('express')
const Multer = require('multer')
const FirebaseStorage = require('multer-firebase-storage-sharp')
const app = new Express()
const multer = Multer({
storage: FirebaseStorage({
bucketName: 'your-default-bucket',
credentials: {
clientEmail: 'your-firebase-client-email',
privateKey: 'your private key',
projectId: 'your-project-id'
},
hooks: {
beforeInit(instance) {
console.log(`before init:`, instance)
},
afterInit(instance, fb) {
console.log(`after init:`, instance, fb)
},
beforeUpload(req, file) {
console.log(`before upload:`, req, file)
},
afterUpload(req, file, fref, bref) {
console.log(`after upload:`, req, file, fref, bref)
},
beforeRemove(req, file) {
console.log(`before remove:`, req, file)
},
afterRemove(req, file, fref, bref) {
console.log(`after remove:`, req, file, fref, bref)
}
}
})
})
app.post('/file', multer.single('file'), (req, res) => {
res.status(201).json(req.file)
})
app.listen(3000, () => {
console.log('Example app listening on port 3000!')
})
const Express = require('express')
const Multer = require('multer')
const FirebaseStorage = require('multer-firebase-storage-sharp')
const sharp = require('sharp')
const app = new Express()
const multer = Multer({
storage: FirebaseStorage({
bucketName: 'your-default-bucket',
credentials: {
clientEmail: 'your-firebase-client-email',
privateKey: 'your private key',
projectId: 'your-project-id'
},
sharpPipeline: sharp().rotate(180).resize({ width: 100, height: 100 }).blur()
})
})
FAQs
Multer Storage Engine for Firebase Storage along with integration with npm sharp library for image manipulation before upload
The npm package multer-firebase-sharp receives a total of 0 weekly downloads. As such, multer-firebase-sharp popularity was classified as not popular.
We found that multer-firebase-sharp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.