Works with any backend npm install Zero dependencies
Magic Byte MIME Validation

Validate file types by reading binary magic bytes, not just the extension.

(function() {
    var logEl = document.getElementById('log');
    function log(m) { var d = document.createElement('div'); d.className='pkg-log-entry'; d.textContent=m; logEl.appendChild(d); logEl.scrollTop=logEl.scrollHeight; }
    new MultipleUpload('#demo', {
        uploadUrl: '/api/upload',
        multiple: true,
        allowedMimeTypes: 'image/jpeg,image/png',
        validateMimeByMagic: true,
        onValidationError: function(msg, name) { log((name||'file') + ': ' + msg); }
    });
})();
Test: Rename a .txt file to .jpg and try uploading. Magic byte validation will catch the mismatch.