Malware check for shared test builds: what it covers and what a hold means

A test build link asks people to trust a file. Usually that trust is well placed: a developer sends a build to a client, a QA team or a few friends. But any service that turns an uploaded file into an install link can also be used to pass on a file that is already known to be malicious. Since November 9, 2026, every build uploaded to AppForShare is checked for known malware, on every plan and for uploads without an account too. This article explains what the check covers, what happens when it matches and where you see the result.

When the check runs

The install link is issued first, so your upload is never slowed down. Right after that, the build is checked in the background, usually within seconds. There is nothing to turn on and nothing to pay for: it is part of the platform, not a plan feature.

Live builds that are less than 72 hours old are checked again once a day with the newest signatures. New malware is added to signature databases every day, so a file that matched nothing on Monday can match on Tuesday.

What is checked

Two checks run on every upload:

• ClamAV. The open source antivirus engine reads the package with archive scanning on. An .apk or .ipa is a zip archive, so ClamAV opens it and checks the files inside, not only the outer file. For an .aab, the APK made from it is checked, and for a zipped .app, the .ipa made from it. ClamAV reads files up to 2 GiB.
• MalwareBazaar. MalwareBazaar is a public database of malware samples run by abuse.ch. We send it the SHA-256 hash of the file (and of the original upload when we converted it) and ask whether that exact file is a known sample. Only the hash leaves our servers. The file itself is never sent.

Files over 2 GiB get the hash lookup only. If an engine cannot run for some reason, the build stays live, our staff can see it, and the check runs again within a day.

What a hold means

When either check matches, the build is held for review:

• The link keeps its address, but the install page says "Held for review" in the tester's language and takes no installs.
• Channels skip the build, so a channel link keeps opening the build before it.
• Our staff get an alert straight away. The owner of an account build gets one email naming the signature that matched. A build uploaded without an account shows the hold on its manage page.
• The file is kept so staff can look at it. Nothing is deleted automatically.

Then a person decides. If the match is wrong, staff release the build and the link takes installs again. A build released after a match is not held again for the same signature. If the match is right, staff remove the build, and the same file cannot be uploaded again. The owner cannot lift a hold alone, which is the point: a hold should be decided by someone who did not upload the file.

If your own build is held, our guide on what to do if your build is held for review walks through the steps.

Where you see the result

• Build page. A clean build shows the date it was checked. A held build shows the hold at the top.
• CI API. The build and the build list carry malwareScan with a status (pending, clean, flagged, error or skipped) and the time of the check.
• CLI. appforshare info <build> prints one line about the check.
• MCP server. list_builds and build_info return the status to your AI coding assistant.

The malware check docs list every status and show the API answer.

What it covers

The check finds malware that is already known: a ClamAV signature or a sample listed in MalwareBazaar. Most known mobile malware targets Android, so there are fewer signatures for iOS apps. That is why it works next to the other parts of upload screening: a file staff removed for abuse cannot be uploaded again, some guest Android builds with a covert surveillance set of permissions are held for a person, and every report from the install page needs a reason. See how reports work.

A malware check is not a security scan

The malware check looks at a file the way a gatekeeper would: is this something already known to be malicious? It protects testers and everyone who shares on the service. A security scan looks at your own build the way a reviewer would: did you leave a key in the code, turn off App Transport Security or ship a debuggable build? AppForShare runs both on every upload. The background is in upload screening and a security scan are different jobs.

Common questions

Which plans include the malware check?

Every plan, and uploads without an account too.

Is my app file sent to another company?

No. ClamAV runs on our servers. Only the SHA-256 hash of the file is sent to MalwareBazaar.

Will the check slow down my upload or CI job?

No. The link is issued first and the check runs right after. A CI job can read the status later from the API.

What about builds uploaded before November 9, 2026?

They were not checked at upload and have no status. Their links keep working as before.

Does a clean result mean testers can skip their own judgement?

No. It means no known malware matched. Testers should still install builds from people they work with and read what the app asks for.

If you share builds with testers or clients, you can make a free AppForShare account and see the check on your next upload. The overview is on the malware check page.