CypherScan

Name: CypherScan
Brand: cyphernetsecurity
Availability: InStock
Author: cyphernetsecurity

Scans Payload upload collections for malware and secrets via the CypherScan API and blocks suspicious files before they persist.

Community 3 160/wk MIT v0.1.5

Installation

$ pnpm add cypherscan-payload

About

CypherScan intercepts files uploaded to Payload CMS upload collections and routes them through the CypherScan scanning service before they are stored. The plugin attaches a `beforeChange` hook to each targeted upload collection, so every incoming file is inspected rather than written straight to disk or your storage adapter. The scanning flow is presigned and stateless from Payload's side. On upload, the plugin asks the CypherScan API for a presigned S3 URL, PUTs the raw file into temporary object storage, triggers a scan, and reads back a verdict of `clean`, `suspicious`, `malicious`, or `unknown`. Files whose verdict matches the configured block list are rejected at the hook, so they never become available inside Payload. Clean files pass through unchanged. Configuration is minimal. You supply an `apiKey` and the CypherScan `apiUrl`, and can optionally restrict scanning to a subset of collections with the `collections` option, tune which verdicts block via `blockVerdicts` (suspicious and malicious by default), and choose a failure mode. `failOpen` (the default) lets uploads proceed if the scanning service is unreachable, which suits development; switching it off enforces fail-closed behavior for production where strict blocking is required. The plugin targets Payload 3 and logs each scan step (file name, type, size, presign status, verdict) through the standard Payload logger. It has been validated against clean uploads, the EICAR malware test string, and both fail-open and fail-closed API outages. Note that it depends on an external CypherScan API key and currently blocks in-line at upload time, so scan latency adds to the request duration for each upload.