Launched September 1, 2026.png?width=160)
pompelmi
free, open-source file scanner
FreeOpen SourceSecurityDevOps3,139 impressions#6 of its week
FOSS file scanner for nodejs.
pompelmi is an open-source Node.js wrapper for ClamAV that scans files for malware with a single function call.
- for
- Node.js developers needing on-premise virus scanning for uploads.
- pricing
- open source
- license
- ISC
- v1.20.0v1.20.0 — Added5 months ago
- v1.19.0v1.19.0 — Scan Cache, Policies, Multi-Engine, Directory Streaming5 months ago
- v1.18.0v1.18.0 — Docker Image, Security Scorecard, VS Code Extension, Quarantine Mode5 months ago
works withNode.jsBunDenoCloudflare WorkersExpressFastifyNestJSNext.jsHonoRemixSvelteKit
Key features
6 features of pompelmi
- One-function API — Call pompelmi.scan(path) and await a typed verdict without config objects.
- Typed verdicts — Returns Verdict.Clean, Verdict.Malicious, or Verdict.ScanError as Symbol constants.
- Cross-platform — Runs on macOS, Linux, and Windows wherever ClamAV is installed.
- No daemon required — Uses clamscan directly, avoiding background clamd processes.
- Zero runtime dependencies — Relies only on Node's built-in child_process, no extra packages.
- Exit-code mapping — Maps ClamAV exit codes directly, eliminating stdout parsing.
Use cases
- Validate user-uploaded files in an Express API before storage
- Scan files in a Next.js serverless function on Vercel
- Integrate malware detection into a Deno or Bun microservice
- Add antivirus checks to Cloudflare Workers edge scripts
pompelmi vs alternatives
.png?width=64) pompelmi | -(2).jpg1696338191590.png?width=64) Node File Router |  Fluent CI |  imgproxy |  Static.app | |
|---|---|---|---|---|---|
| Best for | Zero-dependency ClamAV scanning | File-based routing for Node.js | TypeScript CI/CD pipelines | Self-hosted image processing | One-click static site hosting |
| Pricing | Open source | Free | Free | Free | Subscription |
| DevHunt upvotes | 3 | 123 | 158 | 95 | 130 |
| Launched | Sep 2026 | Jan 2023 | Jan 2024 | Feb 2024 | Jan 2024 |
- pompelmi vs Node File Router: Node File Router provides routing, not virus scanning.
- pompelmi vs Fluent CI: Fluent CI focuses on CI/CD pipelines, not security scanning.
- pompelmi vs imgproxy: imgproxy processes images, whereas pompelmi scans for malware.
- pompelmi vs Static.app: Static.app hosts static sites; pompelmi adds antivirus to uploads.
pompelmi FAQ
What runtime environments does pompelmi support?+
It works on Node.js, Bun, Deno, and Cloudflare Workers.
Do I need to run a ClamAV daemon?+
No, pompelmi calls the clamscan binary directly and does not require a daemon.
How are scan results returned?+
The scan() function returns a Symbol verdict: Verdict.Clean, Verdict.Malicious, or Verdict.ScanError.
What are the system requirements?+
Node.js ≥ 14 and ClamAV installed on the host system (macOS, Linux, or Windows).
Is any additional npm package required?+
No, pompelmi has zero runtime dependencies beyond Node's built-in modules.
Summarized by DevHunt from pompelmi.github.io · Sep 28, 2026. Details may change; check the official site.
