Scan Uploaded Files for Viruses: ClamAV + Node.js Integration

[User Upload] --> [Node.js API Server] --(INSTREAM via TCP 3310)--> [ClamAV Daemon (clamd)]
                        |
                        +--> If Clean: Persist to S3/R2
                        +--> If Infected: Quarantine & Log Security Alert

npm install clamscan

import NodeClam from 'clamscan';

let clamScanInstance: NodeClam | null = null;

async function getClamScanner(): Promise<NodeClam> {
  if (clamScanInstance) return clamScanInstance;

  clamScanInstance = await new NodeClam().init({
    clamdscan: {
      host: process.env.CLAMAV_HOST || '127.0.0.1',
      port: Number(process.env.CLAMAV_PORT) || 3310,
      timeout: 60000,
    },
    preference: 'clamdscan',
  });

  return clamScanInstance;
}

export async function scanUploadedBuffer(fileBuffer: Buffer): Promise<{ isInfected: boolean; viruses: string[] }> {
  const scanner = await getClamScanner();
  const { isInfected, viruses } = await scanner.scanBuffer(fileBuffer);

  if (isInfected) {
    console.warn('MALWARE DETECTED IN UPLOAD:', viruses);
  }

  return { isInfected, viruses };
}