Most Node.js Apps Using ClamAV Have the Same Bug. Here's What It Is.

Calling ClamAV from Node.js looks easy: spawn clamscan, check the exit code, done. But the standard implementation has a silent bug — exit code 2 means "scan could not complete," not "clean," and almost every custom wrapper collapses it into one of the other two outcomes. The result is a false-clean verdict on encrypted archives, permission-denied files, and timeouts. The fix is to model ClamAV's three real outcomes — Clean, Malicious, ScanError — as three explicit return values, and force the caller to handle ScanError as a security decision rather than a programming error. This article explains why this matters, what the failure looks like in production, and what a correct minimal wrapper looks like in practice.