Malware scanning

The answer in CAP is the same BTP service: the attachments plugin@cap-js/attachmentscds-pluginAn official CAP Node.js plugin for attachment handling, with local database storage and AWS S3, Azure Blob or GCP Object Store integration.sap official, cap submits every upload to the Malware Scanning serviceSAP Malware Scanning serviceserviceScans an uploaded file over a REST call, with ClamAV behind it — the check an attachments plugin runs before a file is served back.sap official, btp over REST, with ClamAV behind it, and withholds the download until the scan comes back clean.

Not covered: The service returns only a scan verdict; the plugin around it decides what happens next — retrying against the service's 30-concurrent-request limit, rescanning attachments older than three days, and marking an oversize file failed rather than resubmitting it.