Function execute

worker/src/components/security/virustotal.ts:112–242

({ inputs, params }, context)

    deprecated: false,
  },
  async execute({ inputs, params }, context) {
    const { indicator, apiKey } = inputs;
    const { type } = params;

    if (!indicator) {
      throw new ValidationError('Indicator is required', {
        fieldErrors: { indicator: ['Indicator is required'] },
      });
    }
    if (!apiKey) {
      throw new ConfigurationError('VirusTotal API Key is required', {
        configKey: 'apiKey',
      });
    }

    let endpoint = '';

    // API v3 Base URL
    const baseUrl = 'https://www.virustotal.com/api/v3';

    // Construct endpoint based on type
    switch (type) {
      case 'ip':
        endpoint = `${baseUrl}/ip_addresses/${indicator}`;
        break;
      case 'domain':
        endpoint = `${baseUrl}/domains/${indicator}`;
        break;
      case 'file':
        endpoint = `${baseUrl}/files/${indicator}`;
        break;
      case 'url': {
        // URL endpoints usually require the URL to be base64 encoded without padding
        const b64Url = Buffer.from(indicator)
          .toString('base64')
          .replace(/=/g, '')
          .replace(/\+/g, '-')
          .replace(/\//g, '_');
        endpoint = `${baseUrl}/urls/${b64Url}`;
        break;
      }
    }

    context.logger.info(`[VirusTotal] Checking ${type}: ${indicator}`);

    // If type is URL, we might need to "scan" it first if it hasn't been seen,
    // but typically "lookup" implies retrieving existing info.
    // The GET endpoint retrieves the last analysis.

    const response = await context.http.fetch(endpoint, {
      method: 'GET',
      headers: {
        'x-apikey': apiKey,
        Accept: 'application/json',
      },
    });

    if (response.status === 404) {