
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@nam088/nestjs-configx
Advanced tools
Typed, validated, multi-source configuration for NestJS (>=10).
Typed, validated, multi-source configuration for NestJS (>=10) powered by Zod.
npm install @nam088/nestjs-configx zod
Peer dependencies:
@nestjs/common and @nestjs/core (>=10 <12)// config.schema.ts
import { z } from 'zod';
export const ConfigSchema = z.object({
app: z.object({
name: z.string().default('my-app'),
env: z.enum(['development', 'test', 'production']).default('development'),
port: z.coerce.number().int().min(1).max(65535).default(3000),
}),
database: z.object({
url: z.string().url(),
ssl: z.coerce.boolean().optional(),
}),
});
export type Config = z.infer<typeof ConfigSchema>;
// app.module.ts
import { Module } from '@nestjs/common';
import { ConfigxModule } from '@nam088/nestjs-configx';
import { ConfigSchema } from './config.schema';
@Module({
imports: [
ConfigxModule.forRoot({
schema: ConfigSchema,
isGlobal: true,
// optional
// envFilePath: ['.env', `.env.${process.env.NODE_ENV}`],
// ignoreEnvFile: false,
// cache: true,
}),
],
})
export class AppModule {}
import { Injectable } from '@nestjs/common';
import { ConfigxService } from '@nam088/nestjs-configx';
import type { Config } from './config.schema';
@Injectable()
export class AppService {
constructor(private readonly config: ConfigxService) {}
getPort(): number {
// Strongly-typed path access when using generics
return this.config.get<number>('app.port') ?? 3000;
}
getDbUrl(): string {
return this.config.getOrThrow('database.url');
}
}
Or inject via decorator:
import { Injectable } from '@nestjs/common';
import { InjectConfigx, ConfigxService } from '@nam088/nestjs-configx';
@Injectable()
export class Example {
constructor(@InjectConfigx() private readonly cfg: ConfigxService) {}
}
APP_NAME=my-app
APP_ENV=production
APP_PORT=8080
DATABASE_URL=https://example.com
DATABASE_SSL=true
By default, variables are loaded from .env (if present) and expanded (dotenv + dotenv-expand). You can customize with envFilePath or disable with ignoreEnvFile.
ConfigxModule.forRootAsync({
inject: [SomeService],
useFactory: (svc: SomeService) => ({
schema: ConfigSchema,
isGlobal: true,
envFilePath: svc.getEnvFiles(),
cache: true,
}),
});
ConfigxModule.forRoot(options)ConfigxModule.forRootAsync(options)options:
schema (required): Zod schemaisGlobal (default: false)envFilePath?: string | string[] (default: '.env')ignoreEnvFile?: boolean (default: false)cache?: boolean (default: false) — enables get() result caching per pathConfigxServiceget<T>(path: string): T | undefinedgetOrThrow<T>(path: string, message?: string): TgetString(path, defaultValue?)getNumber(path, defaultValue?)getBoolean(path, defaultValue?)getJSON<T>(path, defaultValue?)getEnum<T extends string>(path, values: readonly T[], defaultValue?)getAll<T = Record<string, unknown>>(): T — returns the validated treehas(path: string): booleanset<T>(path: string, value: T): void — updates in-memory validated config and process.env[path]namespaced(prefix: string) — returns the same getters scoped by prefixrefresh(): Promise<void> — reloads from source and re-validates (clears cache when enabled)Type-safe path access is supported via generics when you thread your schema shape through your service typing.
See a runnable example in examples/basic-use.
npm run build # build to dist
npm run test # unit tests
npm run test:cov # coverage
npm run lint # eslint
npm run format # prettier
MIT © Nam088
FAQs
Typed, validated, multi-source configuration for NestJS (>=10).
We found that @nam088/nestjs-configx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.