plugin malware-scan

[mkf-sysangels]

about the plugin

This plugin is a replacement for the existing "clamav" and "virustotal" plugins.

These two original plugins only work with HTTP/1.1 - the HTTP/2 and HTTP/3 uploads are broken.

Description

The plugin malware-scan uses several services to obtain information on uploaded files:

• abuse.ch - MalwareBazaar hash database
• ClamAV scan
• virustotal.com lookup (user needs to register for API key)

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

This PR introduces the malware-scan plugin, a replacement for the existing clamav and virustotal plugins with enhanced HTTP/2 and HTTP/3 support. The plugin provides multi-layer malware scanning using ClamAV, VirusTotal, SentinelOne, and MalwareBazaar hash database integration.

Changes:

• Implemented comprehensive malware scanning with multiple detection services (ClamAV local, VirusTotal, SentinelOne, MalwareBazaar)
• Added caching infrastructure with differential TTL and Redis-backed hash lookups
• Integrated webhook notifications for Discord and Microsoft Teams

Reviewed changes

Copilot reviewed 32 out of 40 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
malware-scan/malware_scan_virustotal.lua	VirusTotal API integration with hash lookups, file uploads, and voting functionality
malware-scan/malware_scan_utils.lua	Utility functions for validation, sanitization, and safe arithmetic operations
malware-scan/malware_scan_ui_metrics.lua	UI metrics tracking for scan statistics and detection history
malware-scan/malware_scan_sentinelone.lua	SentinelOne API integration for threat hash lookups
malware-scan/malware_scan_multipart_full_scan.lua	Multipart upload parsing and per-file scanning functionality
malware-scan/malware_scan_metrics.lua	Prometheus-compatible metrics for operational monitoring
malware-scan/malware_scan_malwarebazaar.lua	Redis-backed MalwareBazaar hash database lookups
malware-scan/malware_scan_logger.lua	Centralized logging with sensitive data sanitization
malware-scan/malware_scan_init.lua	Module loading and dependency initialization
malware-scan/malware_scan_filetypes.lua	File type categorization for risk assessment
malware-scan/malware_scan_database.lua	Redis connection management and circuit breaker
malware-scan/malware_scan_custom_hashes.lua	Custom hash database management with bucketed storage
malware-scan/malware_scan_clamav.lua	ClamAV INSTREAM protocol integration
malware-scan/malware-scan.lua	Main plugin entry point with orchestrated scanning workflow
malware-scan/jobs/malware-scan-update.lua	Scheduled hash database update job
malware-scan/jobs/malware-scan-cache-cleanup.py	Python job for cache cleanup on startup
malware-scan/jobs/README.md	Job scripts documentation
malware-scan/install.sh	Automated ClamAV installation script
malware-scan/install.md	ClamAV installation guide
malware-scan/TECHNICAL.md	Technical documentation for developers
malware-scan/SECURITY.md	Security policy and vulnerability reporting
malware-scan/README.md	Plugin overview and configuration guide

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.