
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@nestjs/azure-storage
Advanced tools
A progressive Node.js framework for building efficient and scalable server-side applications.
Azure Storage module for Nest framework (node.js)
Learn how to get started with Azure table storage for NestJS
Using the Nest CLI:
$ nest add @nestjs/azure-storage
You can pass additional flags to customize the post-install schematic. For example, if your base application directory is different than src, use --rootDir flag:
$ nest add @nestjs/azure-storage --rootDir app
When requested, provide the storageAccountName and storageAccountSAS (see below).
Other available flags:
rootDir - Application root directory, default: srcrootModuleFileName - the name of the root module file, default: app.modulerootModuleClassName - the name of the root module class, default: AppModulemainFileName - Application main file, default: mainskipInstall - skip installing dependencies, default: falsestorageAccountName (required) - The Azure Storage account name (see: http://bit.ly/azure-storage-account)storageAccountSAS (required) - The Azure Storage SAS Key (see: http://bit.ly/azure-storage-sas-key).$ npm i -S @nestjs/azure-storage
.env file with the following content:# See: http://bit.ly/azure-storage-sas-key
AZURE_STORAGE_SAS_KEY=
# See: http://bit.ly/azure-storage-account
AZURE_STORAGE_ACCOUNT=
The SAS has the following format:
?sv=2018-03-28&ss=bfqt&srt=sco&sp=rwdlacup&se=2019-12-31T22:54:03Z&st=2019-07-11T13:54:03Z&spr=https,http&sig=WmAl%236251oj11biPK2xcpLs254152H9s0%3D
IMPORTANT: Make sure to add your .env file to your .gitignore! The .env file MUST NOT be versionned on Git.
Make sure to include the following call to your main file:
if (process.env.NODE_ENV !== 'production') require('dotenv').config();
This line must be added before any other imports!
AzureStorageModule with the following configuration:import { Module } from '@nestjs/common';
import { AppController } from './app.controller';
import { AppService } from './app.service';
import { AzureStorageModule } from '@nestjs/azure-storage';
@Module({
controllers: [AppController],
providers: [AppService],
imports: [
AzureStorageModule.withConfig({
sasKey: process.env['AZURE_STORAGE_SAS_KEY'],
accountName: process.env['AZURE_STORAGE_ACCOUNT'],
containerName: 'nest-demo-container',
}),
],
})
export class AppModule {}
If you want to use asynchronous configuration options using factory or class,
const storageConfigFactory = async () => {
sasKey: process.env['AZURE_STORAGE_SAS_KEY'],
accountName: process.env['AZURE_STORAGE_ACCOUNT'],
containerName: 'nest-demo-container',
};
@Module({
controllers: [AppController],
providers: [AppService],
imports: [
AzureStorageModule.withConfigAsync({
useFactory: storageConfigFactory,
}),
],
})
export class AppModule {}
You may provide a default
containerNamename for the whole module, this will apply to all controllers withing this module. You can also provide (override) thecontainerNamein the controller, for each route.
import {
Controller,
Logger,
Post,
UploadedFile,
UseInterceptors,
} from '@nestjs/common';
import { FileInterceptor } from '@nestjs/platform-express';
import {
AzureStorageFileInterceptor,
UploadedFileMetadata,
} from '@nestjs/azure-storage';
@Controller()
export class AppController {
@Post('azure/upload')
@UseInterceptors(
AzureStorageFileInterceptor('file'),
)
UploadedFilesUsingInterceptor(
@UploadedFile()
file: UploadedFileMetadata,
) {
Logger.log(`Storage URL: ${file.storageUrl}`, 'AppController');
}
}
import {
Controller,
Logger,
Post,
UploadedFile,
UseInterceptors,
} from '@nestjs/common';
import { FileInterceptor } from '@nestjs/platform-express';
import {
AzureStorageFileInterceptor,
UploadedFileMetadata,
} from '@nestjs/azure-storage';
@Controller()
export class AppController {
@Post('azure/upload')
@UseInterceptors(
AzureStorageFileInterceptor('file', null, {
containerName: 'nest-demo-container-interceptor',
}),
)
UploadedFilesUsingInterceptor(
@UploadedFile()
file: UploadedFileMetadata,
) {
Logger.log(`Storage URL: ${file.storageUrl}`, 'AppController');
}
}
import {
Controller,
Logger,
Post,
UploadedFile,
UseInterceptors,
} from '@nestjs/common';
import { FileInterceptor } from '@nestjs/platform-express';
import {
AzureStorageFileInterceptor,
AzureStorageService,
UploadedFileMetadata,
} from '@nestjs/azure-storage';
@Controller()
export class AppController {
constructor(private readonly azureStorage: AzureStorageService) {}
@Post('azure/upload')
@UseInterceptors(FileInterceptor('file'))
async UploadedFilesUsingService(
@UploadedFile()
file: UploadedFileMetadata,
) {
file = {
...file,
originalname: 'foo-bar.txt',
};
const storageUrl = await this.azureStorage.upload(file);
Logger.log(`Storage URL: ${storageUrl}`, 'AppController');
}
}
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Nest is MIT licensed.
FAQs
An Azure Storage module for Nest framework (node.js)
The npm package @nestjs/azure-storage receives a total of 1,156 weekly downloads. As such, @nestjs/azure-storage popularity was classified as popular.
We found that @nestjs/azure-storage demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.