My implementation of blossom-server does not check the file. although there is nothing stopping a blossom server from rejecting or removing a blob if its flagged as a virus
Probably could fork and it would be a few lines of code https://github.com/hzrd149/blossom-server 😀