Pompelmi
Route-level file upload security for Node.js, scanning files for malware, spoofing, and risky archives before storage.
What is Pompelmi?
Pompelmi is an open-source file upload security scanner for Node.js applications. It inspects untrusted uploads at the route level before storage to detect malware, MIME and extension spoofing, risky archive structures, and suspicious document signals. It helps developers secure public or semi-trusted upload endpoints by providing clear verdicts that inform storage decisions.
Node.js developers building applications with file upload features, especially those using frameworks like Express, Next.js, NestJS, Fastify, or Koa, and teams needing to implement inspect-first security for public-facing endpoints or CI/CD artifact scanning.
Developers choose Pompelmi because it integrates directly into their application routes, providing context-aware security scanning before files hit storage. Unlike simple file-type checks or standalone antivirus, it combines spoofing detection, structural analysis, and optional YARA matching with framework-specific middleware for seamless adoption.
Overview
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
Use Cases
Best For
- Securing public file upload endpoints in Node.js web applications
- Implementing quarantine and promotion workflows for S3 or object storage
- Adding malware scanning to CI/CD pipelines for build artifacts
- Preventing archive-based attacks like ZIP bombs and path traversal in uploaded files
- Validating file types and detecting MIME/extension spoofing in user uploads
- Integrating YARA rule matching into a Node.js application security layer
Not Ideal For
- Applications that process file uploads asynchronously or in batch jobs after files are already stored, as Pompelmi is designed for immediate, pre-storage inspection at the route level.
- Teams using non-Node.js backend frameworks like Django, Spring Boot, or Rails, since Pompelmi is exclusively built for Node.js and its ecosystems.
- High-volume file upload services where in-memory scanning of every file would introduce unacceptable latency or memory overhead, especially for large files.
- Projects that require deep, real-time antivirus signature matching as their primary defense, as Pompelmi is not a full antivirus replacement and relies on optional YARA integration for such checks.
Pros & Cons
Pros
Validates files by comparing magic bytes, client-reported MIME types, and extensions against allowlists, effectively preventing common spoofing attacks as highlighted in the key features.
Detects complex threats like ZIP bombs, path traversal, and entry-count abuse in archives, which are often missed by basic file-type checks, reducing risk from malicious uploads.
Provides dedicated middleware and documentation for Express, Next.js, NestJS, and other popular Node.js frameworks, making it easy to drop into existing applications with minimal setup.
Returns clear classifications (clean, suspicious, malicious) that enable applications to implement reject, quarantine, or promote workflows seamlessly, supporting context-aware security decisions.
Cons
Only supports Node.js environments, limiting its use in polyglot or non-JavaScript backend stacks without complex workarounds, as evident from the framework integrations listed.
Requires full file buffering in memory for analysis, which can be resource-heavy for large files or high-concurrency scenarios, potentially impacting server performance.
Demands careful tuning of security policies (e.g., STRICT_PUBLIC_UPLOAD) and YARA rules, which may be daunting for teams without dedicated security expertise to avoid false positives or gaps.
Frequently Asked Questions
Related Projects
DOMPurifyDOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
CheckovPrevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
TFSecTfsec is now part of Trivy
js-xssSanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.