POMPELMI

Summary from the TLDR InfoSec newsletter

Pompelmi is an open-source Node.js upload security library that performs local, in-process scanning for spoofed files, archive bombs (ZIP traversal and nesting), polyglots, and script-bearing document structures without requiring a cloud API or daemon. It exposes typed verdicts with structured reasons for allow, quarantine, and reject flows, and ships framework adapters for Express, Next.js, NestJS, Koa, and Fastify with optional YARA and ClamAV integration.