How would you scan uploaded files for malware before accepting them into permanent storage in a Node.js application?

A common approach integrates with a virus-scanning engine like ClamAV, running either as a local daemon the Node.js process communicates with over a socket (via a library like clamscan), or as a separate managed cloud service -- the uploaded file is scanned before being moved from a temporary quarantine location to permanent storage, and rejected (with the temporary file deleted) if the scan detects a threat, adding a crucial security layer for any application accepting file uploads from untrusted users.

const NodeClam = require('clamscan');
const clamscan = await new NodeClam().init({ clamdscan: { socket: '/var/run/clamav/clamd.ctl' } });

const { isInfected, viruses } = await clamscan.isInfected(req.file.path);
if (isInfected) {
  await fs.promises.unlink(req.file.path);
  return res.status(400).json({ error: 'File failed security scan', viruses });
}