
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
strapi-provider-firebase-storage
Advanced tools
A storage provider for the Strapi CMS that manages file uploads to Firebase Storage
This is a Strapi provider that will upload your files to Firebase Storage.
npm install strapi-provider-firebase-storage
You may run into an issue displaying the image where CORS is blocking it. If that happens open ./config/middwares.js and replace strapi::security with this:
{
name: "strapi::security",
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
"connect-src": ["'self'", "https:"],
"img-src": [
"'self'",
"data:",
"blob:",
"storage.googleapis.com",
"dl.airtable.com",
],
"media-src": [
"'self'",
"data:",
"blob:",
"storage.googleapis.com",
"dl.airtable.com",
],
upgradeInsecureRequests: null,
},
},
},
},
It will whitelabel images coming from Google Cloud Storage in the CORS settings.
Here is a sample usage:
module.exports = ({ env }) => {
return {
...
upload: {
config: {
provider: "strapi-provider-firebase-storage",
providerOptions: {
serviceAccount: require("path/to/my/serviceAccount.json"),
// Custom bucket name
bucket: env(
"STORAGE_BUCKET_URL",
"my-bucket-name.appspot.com"
),
sortInStorage: true, // true | false
debug: false, // true | false
},
},
},
...
};
};
| Option | Is Required | Default | Notes |
|---|---|---|---|
serviceAccount | true | none | This is just the path to your service account file |
bucket | false | none | If you leave this blank it should go to your default bucket, but I'd recommend putting your default bucket name anyway |
sortInStorage | false | true | This will sort files in your firebase storage bucket into folders |
debug | false | false | This will just log all the steps to the console |
sortInStorage optionBy default Strapi will just output all the files in the default bucket with no folder structure (even if you make folders in the Strapi admin UI). Strapi also creates variants of files (like iamges ex. thumbnails) so if you upload an image to Strapi you'll actually have like a few variants of it actually uploaded to Firebase.
If you were to look at that in Firebase it would look like total chaos. So what I did was create a couple of functions that will upload your files based on mime type as well as sort all variants of an image under a single folder. If you wanted to do something else with those images (for example create triggers for uploads for specific folders) they will be sorted nicely for you.
Alos be really careful toggling the sortInStorage option. If you have it on, upload some files, then turn it off the
delete function could break for the files that were uploaded when it was turned on.
FAQs
A storage provider for the Strapi CMS that manages file uploads to Firebase Storage
We found that strapi-provider-firebase-storage demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.