There's no client-based solution. The best option is to add virus-scanning to middleware on your API that dumps any file that fails the scan.