NETROOM
Excalidraw is a virtual whiteboard for diagrams in a hand-drawn style: architecture sketches, user flows, wireframes and anything else that is quicker to draw than to describe. It runs in the browser with no sign-up - open a tab and start drawing. There are libraries of ready-made shapes, export to PNG and SVG, collaboration over a link with end-to-end encrypted rooms, and files you can keep locally or in your own storage. Open source, with a self-hosted option for teams.
Squoosh compresses images in the browser: drop a file in, pick a format and a quality, download the result. A slider puts the original and the compressed version side by side, so you can see exactly where artefacts start and stop just before them. It handles a range of formats, each with its own controls - from a single quality dial to the codec's own parameters. Nothing is uploaded: the work happens on your device, and it runs offline once installed as an app. Built by Google Chrome Labs, open source, no sign-up.
The Cyber Swiss Army Knife, built by the UK's GCHQ. You chain operations into a "recipe" and push text or a file through it: base64, XOR, AES, DES, Blowfish, hashes, hexdumps, X.509 and IPv6 parsing, archive extraction, charset conversion. Everything runs in the browser - nothing is sent to a server, and you can download the page and use it offline. Apache 2.0 plus Crown Copyright. Invaluable for picking apart logs, dumps and suspicious payloads.
A Swiss army knife for PDFs in the browser, running on your own server: merge and split, rotate, compress, convert to and from office formats, OCR, sign, redact, and chain operations through a REST API - over fifty tools in all. The point is that files never reach someone else's cloud. One docker run gets you going, and a desktop client and Kubernetes charts exist too. It is open core: the base is open source while some capabilities sit behind paid Server and Enterprise plans.
Sets protective HTTP headers with one app.use(): CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Cross-Origin-*. The defaults are sane, but CSP almost always needs tuning for your frontend or inline scripts and third-party widgets break. v8 requires Node 18+, ships dual ESM/CJS and has no dependencies. In Nest, app.use() it before routes; with Fastify use @fastify/helmet. You can also set these headers at the reverse proxy and skip helmet entirely.
A wrapper over Nest's DiscoveryService that does exactly what you come for: find every provider and handler tagged with your own decorator. If you are building a custom @OnEvent-style decorator, this collects the metadata in one call instead of walking the container by hand. Mostly useful to library authors and internal platform modules; in ordinary feature code it is overkill. Peers are @nestjs/core and @nestjs/common 11.x, so verify compatibility on Nest 12.
CLI apps in Nest: @Command and @Option decorators on top of commander, with normal DI inside the command - the same services your HTTP layer uses. Handy for migrations, seeds and one-off maintenance scripts when spinning up a separate project is not worth it. There is an inquirer wrapper for interactive prompts (it pulls @types/inquirer as a peer). The alternative is NestFactory.createApplicationContext() plus hand-parsed argv, but then parsing and help are on you. Supports Nest 8 through 12.
Continuation-local storage over AsyncLocalStorage, wired into Nest's DI. Stash a request id, user or tenant into ClsService once in middleware and read it from any service instead of threading context through ten layers of arguments. Ships a typed store and transactional plugins for Prisma, TypeORM and Kysely. Note the peer range still reads @nestjs/core >=10 <12, so on Nest 12 you need --legacy-peer-deps or a wait.
You describe a Zod contract once and both sides use it: the Nest controller implements it and the compiler checks paths, bodies and responses. The edge over plain @nestjs/swagger is that the frontend gets a typed client rather than OpenAPI-generated code you have to regenerate on every change. The downside is real: 3.52.1 has sat since March 2025, the peer range stops at Nest 11, and only Zod 3 is supported - Zod 4 and Nest 12 take workarounds. If the whole stack is TypeScript, weigh tRPC too.
Parses multipart/form-data - file uploads on Express and therefore on Nest, where FileInterceptor is a thin wrapper over exactly this. It writes to memory or to disk; large files in memory will take the process down on RAM. The 2.x line followed a series of CVEs in 1.x, so upgrading is not optional. Always set size and count limits, the defaults barely exist. Fastify has its own path via @fastify/multipart. For S3, presigned URLs bypassing the app are saner.
Localising backend responses: translations in JSON or YAML, language resolvers reading Accept-Language, query params, cookies or a custom header. I18nService.translate works in services and exception filters alike, and it hooks into class-validator so validation messages get translated too. ICU MessageFormat formatting, generated key types. Requires Node 22+. It does not replace i18next on the frontend - server strings only.
Email through nodemailer with templating: Handlebars, Pug, EJS, Liquid or MJML, with CSS inlining built in. MailerModule.forRootAsync pulls SMTP settings from ConfigService, then mailerService.sendMail takes a template name and a context object. Community-maintained rather than Nest core, but alive - releases through 2026. It declares a long list of optional peers, so install only the template engine you actually use or npm will complain.
One genuinely useful function - createMock<T>(), which produces a typed mock of any interface or class, nested objects included, without listing methods by hand. In Nest tests it removes the pain of mocking ExecutionContext, Repository and services with a dozen methods. It is Jest-specific: it returns jest.fn() and relies on Jest matchers, so Vitest needs a different tool. Small package, released rarely because the API settled long ago.
A transformer that runs your TypeScript through the real tsc for Jest: full type checking inside the tests, tsconfig path aliases, and accurate source maps in stack traces. It is what the nest new template ships with. The price is speed - on a large suite it lags noticeably behind @swc/jest or esbuild, which simply strip types. Version 29.4.12 is from July 2026 and works with Jest 29 and 30 and TypeScript up to 6.x. ESM mode is configurable but still means fiddling with extensionsToTreatAsEsm.
Fires HTTP requests straight at your app without binding a port: hand it app.getHttpServer() and write .get('/users').expect(200). The default for e2e tests in Nest - it ships in the nest new template alongside @nestjs/testing. Superagent underneath, hence the chaining and .expect(). Version 7.2.2 landed in January 2026 and the package lives under the Ladjs umbrella. Types come separately as @types/supertest. When you need the real network stack - proxy headers, timeouts, keep-alive - start a server and use plain fetch instead.
In-process events on EventEmitter2: put @OnEvent('order.created') on a method and call eventEmitter.emit anywhere. Supports wildcard patterns, dot namespaces, async listeners and emitAsync when you need results back. A cheap way to decouple modules without CQRS ceremony. Remember it is one process's memory: no persistence, no retries, no delivery to the pod next door - for that you want a queue or a broker.
CQRS without heavy infrastructure: commands, queries, events and sagas built on rxjs, all in one process. CommandBus and QueryBus split writes from reads across separate handlers; EventBus plus sagas chain reactions to events. It is neither a broker nor an event store - events vanish on restart, and cross-service delivery needs @nestjs/microservices or Kafka. Worth it on a rich domain; on plain CRUD it is three extra files per operation.
Counts requests per key (IP by default) and answers 429 above the limit. Enough to shield login, password reset and a public API. The default store is process memory, so across a cluster or several pods the limit smears - use rate-limit-redis or the Memcached store. v8 wants Node 16+ and Express 4.11+, and works on Express 5. Set trust proxy yourself, or every client behind a load balancer collapses into one IP. Nest ships its own @nestjs/throttler.
Express middleware that gzip/deflate/brotli-compresses responses based on Accept-Encoding. Worth having when Node faces the internet directly. If nginx, Cloudflare or an ALB sits in front, compress there instead - it is cheaper and does not burn the event loop per response. One gotcha: with SSE and streaming the response gets buffered, so you need an explicit flush or a Content-Type filter. Works in Nest via app.use(). The engines field is ancient (Node 0.8) but the package is maintained by the Express team.
Rate limiting as a guard: a global ThrottlerGuard or a per-route @Throttle decorator, with several named limits at once - a short and a long window side by side. Works on Express, Fastify, WebSockets and GraphQL. Counters live in process memory by default, so a multi-instance deploy needs external storage such as @nest-lab/throttler-storage-redis, or your limit silently multiplies by the pod count. The 6.5.0 release is from December 2025, but its peer range still stops at Nest 11 - expect friction on Nest 12.
Heads up: this package is marked deprecated and npm points you at @prometheus-io/client - the same code, moved under the official Prometheus org at prometheus/client_js. The client itself is unchanged in spirit: counters, histograms, gauges, default process metrics and a registry you expose on /metrics. Move now rather than later: the API is nearly identical and only the name changed, but the new package requires Node 22+ where the old one ran on 16. 15.1.3 has sat since June 2024 and will get no more releases.
OpenTelemetry for Nest without the boilerplate: middleware exposing standard HTTP metrics, @Span and @OtelInstanceCounter decorators, and TraceService for the active span. It does not bootstrap the SDK - you configure the Node tracer in a separate instrumentation file loaded before bootstrap. Licensed Apache-2.0, not MIT, and needs Node 22+. Heads-up: the peer range is still @nestjs/core >=11 <12, so Nest 12 is not officially supported yet.
The official Sentry SDK for Nest: it catches unhandled exceptions via SentryGlobalFilter, traces controllers, providers and queues, and shows spans for outbound HTTP and database calls. Initialisation must live in a separate instrument.ts that is imported first - otherwise OpenTelemetry misses the instrumentation hooks and your traces come back empty. Release 10.73.0 is from August 2026 and they ship close to weekly; the peer range still tops out at Nest 11. Needs Node 18+, and an ESM build is included.
Wraps prom-client into a Nest module: PrometheusModule.register() exposes /metrics, while counters and histograms are declared with makeCounterProvider and injected through the @InjectMetric decorator. It saves a day of registry and DI plumbing. One thing to weigh right now: the peer range pins prom-client ^15, and prom-client itself is deprecated in favour of @prometheus-io/client, with Nest capped at 11. The package is alive - 6.1.0 came out in March 2026 - but a client migration is ahead. Apache-2.0 licensed.
Health checks for Nest: a /health endpoint covering the database, disk, memory, outbound HTTP dependencies and gRPC. Indicators for TypeORM, Prisma, Mongoose, Sequelize and MikroORM ride on optional peer deps, so nothing unused gets pulled in. The response shape is what kubelet and load balancers expect, which makes readiness and liveness probes an evening of work. Version 12 needs Node 20.19+ and Nest 11 or 12. A hand-rolled endpoint is cheaper - this one already has the full set and one error format.
The kitchen-sink logger: transports to file, console, HTTP and a hundred third-party services, plus formatters, levels and rotation via winston-daily-rotate-file. You pick it for the transport ecosystem, or when logs must fan out to several sinks at once. You pay in throughput: pino is several times faster because it does not format on the main thread. Version 3.19.0 is from December 2025; the 3.x line has been stable for years and the promised v4 never arrived. In containers skip file transports - write JSON to stdout and parse it outside.
Swaps Nest's built-in logger for winston: WinstonModule.createLogger at bootstrap, and every framework Logger call lands in your transports - file, JSON on stdout, Elastic. Worth it when an external system collects the logs and dictates the format. The peer range stops at @nestjs/common 11, so Nest 12 needs verification before you rely on it. The alternative most teams reach for now is pino via nestjs-pino: noticeably faster on JSON and non-blocking.
The NATS client for Node - pub/sub, request-reply, JetStream. The package is deprecated: development moved into the nats.js monorepo, and you now install @nats-io/transport-node plus separate @nats-io/jetstream and @nats-io/kv modules. The old name is frozen at 2.29.x and gets no updates. For a new service go straight to the new packages - modular layout, less weight. @nestjs/microservices still targets the old name for its NATS transport, so check before upgrading.
Editors' picks