
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
zola-nestjs-shared
Advanced tools
A shared package for NestJS applications providing common utilities, modules, and services.
npm install zola-nestjs-shared
If you encounter an error during installation related to husky not being found:
npm error 'husky' is not recognized as an internal or external command
This is caused by the nestjs-minio-client dependency having a problematic postinstall script. To work around this, install with the --ignore-scripts flag:
npm install zola-nestjs-shared --ignore-scripts
Note: This will skip all postinstall scripts, including the problematic one from nestjs-minio-client. The package will still function correctly as the postinstall script is only for setting up git hooks in the nestjs-minio-client repository itself, not required for runtime functionality.
If you prefer not to use --ignore-scripts, you can install husky as a dev dependency in your consuming project:
npm install --save-dev husky
npm install zola-nestjs-shared
However, this is not recommended as it adds an unnecessary dependency to your project.
This package requires the following peer dependencies to be installed in your consuming project:
@nestjs/common: ^10.0.0 || ^11.0.0@nestjs/core: ^10.0.0 || ^11.0.0@nestjs/config: ^3.0.0 || ^4.0.0@nestjs/jwt: ^10.0.0 || ^11.0.0@nestjs/passport: ^10.0.0 || ^11.0.0@nestjs/platform-express: ^10.0.0 || ^11.0.0reflect-metadata: ^0.1.0 || ^0.2.0rxjs: ^7.0.0 || ^8.0.0Optional peer dependencies (only needed if using specific features):
@nestjs/schedule: ^4.0.0 || ^5.0.0 || ^6.0.0 (for scheduling features)@nestjs/swagger: ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 (for Swagger/OpenAPI)@nestjs/throttler: ^5.0.0 || ^6.0.0 (for rate limiting)@nestjs/microservices: ^10.0.0 || ^11.0.0 (for microservices)amqplib: ^0.10.0 (required only if using audit features with RabbitMQ)@nestjs/typeorm: ^10.0.0 || ^11.0.0 (for TypeORM features)typeorm: ^0.3.0 (for TypeORM features)Important: You can use this package without amqplib even if you import AuditModule. The module will automatically detect if dependencies are available and only enable audit features if both @nestjs/microservices and amqplib are installed.
The amqplib dependency is only required when you want to actually use audit logging features:
Importing AuditModule - This is now safe even without amqplib:
import { AuditModule } from 'zola-nestjs-shared';
@Module({
imports: [AuditModule], // ✅ Safe - will work without amqplib (audit features will be disabled)
})
Using audit decorators or interceptors - These will only work if dependencies are installed:
import { AuditLoggerInterceptor } from 'zola-nestjs-shared';
import { AUDIT_RMQ_EVENT } from 'zola-nestjs-shared';
If you plan to use the audit logging features (which use RabbitMQ), you must install both @nestjs/microservices and amqplib:
npm install @nestjs/microservices amqplib
Note: The audit module uses RabbitMQ (Transport.RMQ) for event logging. The module will automatically check if amqplib and @nestjs/microservices are available:
You can safely import AuditModule without amqplib - the package will work correctly for all other features, and audit features will simply be disabled.
import { Module } from '@nestjs/common';
import { AuthorizationModule } from 'zola-nestjs-shared';
@Module({
imports: [AuthorizationModule],
})
export class AppModule {}
ISC
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.