pompelmi

Name: pompelmi
Availability: InStock
Author: Tommaso Bertocchi

In-process file upload security for Node.js

by Tommaso Bertocchi

FreeWeb

Visit website

Upvotes: 5
Comments: 0
Impressions: 246

About

Pompelmi is an in-process file upload security toolkit for Node.js. It is designed to reduce risk at the upload endpoint by scanning files locally before they are stored or later parsed/served. Instead of trusting filenames, extensions, or client-provided MIME types, it inspects file bytes and structure to detect disguised files and common abuse patterns. Checks include magic-byte validation, archive protections such as ZIP bomb, traversal, and nesting depth limits, and heuristics for risky structures like executables, polyglots, and script-bearing or macro-hinting documents. It returns structured scan reports with verdicts and reasons, enabling applications to allow, quarantine, or reject uploads with fail-closed behavior. Pompelmi is “private by design,” avoiding cloud APIs and daemon services, and provides integrations for popular Node.js frameworks (Express, Next.js, Koa, NestJS, Fastify), plus CLI and UI components.

Problem & solution

Problem

Node.js apps store risky uploaded files due to weak MIME/extension checks.

Solution

Scans uploads in-process, inspecting bytes/archives to allow, quarantine, or reject.

Who it's for

Node.js teams building file upload endpoints.

Main features

MIME sniffing
ZIP bomb protection
Polyglot detection
Risky document checks
Optional YARA rules