
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
@workflow/nest
Advanced tools
NestJS integration for Workflow DevKit.
npm install @workflow/nest
# or
pnpm add @workflow/nest
You also need to install the SWC packages required by NestJS's SWC builder:
npm install -D @swc/cli @swc/core
# or
pnpm add -D @swc/cli @swc/core
After installing the package, run the init command to generate the SWC configuration:
npx @workflow/nest init
This creates a .swcrc file configured with the Workflow SWC plugin for client-mode transformations.
Important: Add .swcrc to your .gitignore as it contains machine-specific absolute paths:
echo '/.swcrc' >> .gitignore
Ensure your nest-cli.json has SWC as the builder:
{/@skip-typecheck: Shows nest-cli.json configuration/}
{
"compilerOptions": {
"builder": "swc"
}
}
In your app.module.ts:
{/@skip-typecheck: Shows WorkflowModule import/}
import { Module } from '@nestjs/common';
import { WorkflowModule } from '@workflow/nest';
@Module({
imports: [WorkflowModule.forRoot()],
})
export class AppModule {}
Create workflow files in your src/ directory with "use workflow" and "use step" directives:
{/@skip-typecheck: Shows workflow file/}
// src/workflows/example.ts
export async function myStep(data: string) {
'use step';
return data.toUpperCase();
}
export async function myWorkflow(input: string) {
'use workflow';
const result = await myStep(input);
return result;
}
Add scripts to regenerate configuration before builds:
{
"scripts": {
"prebuild": "npx @workflow/nest init --force",
"build": "nest build"
}
}
{/@skip-typecheck: Shows WorkflowModule.forRoot options/}
WorkflowModule.forRoot({
// Directory to scan for workflow files (default: ['src'])
dirs: ['src'],
// Output directory for generated bundles (default: '.nestjs/workflow')
outDir: '.nestjs/workflow',
// Skip building in production when bundles are pre-built
skipBuild: false,
});
The @workflow/nest package provides:
.well-known/workflow/v1/.swcrc configuration with the SWC plugin properly resolvedNestJS uses its own SWC builder that reads configuration from .swcrc. The Workflow SWC plugin needs to be referenced by path in this file. The CLI resolves the plugin path from @workflow/nest's dependencies, eliminating the need for manual configuration or pnpm hoisting.
When you run npx @workflow/nest init, it:
@workflow/swc-plugin (bundled as a dependency of @workflow/nest).swcrc with the absolute path to the pluginThis approach ensures:
.npmrcsrc/NestJS's SWC builder only compiles files within the sourceRoot directory (typically src/). For the workflow client-mode transform to work, workflow files must be in src/ so they get compiled with the SWC plugin that attaches workflowId properties needed by start().
{/@skip-typecheck: Shows WorkflowModule usage/}
import { WorkflowModule } from '@workflow/nest';
// Basic usage
WorkflowModule.forRoot()
// With options
WorkflowModule.forRoot({
dirs: ['src/workflows'],
outDir: '.nestjs/workflow',
skipBuild: process.env.NODE_ENV === 'production',
})
# Generate .swcrc configuration
npx @workflow/nest init
# Force regenerate (overwrites existing)
npx @workflow/nest init --force
# Show help
npx @workflow/nest --help
Apache-2.0
FAQs
NestJS integration for Workflow DevKit
The npm package @workflow/nest receives a total of 2,041 weekly downloads. As such, @workflow/nest popularity was classified as popular.
We found that @workflow/nest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.