YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
NPZ Compressed NPY Member Decompression DoS
Target
NPZ model format.
Summary
npz_compressed_npy_dos.npz is a small compressed NPZ file that contains a single valid weights.npy member. The NPZ file is about 4.17 MiB on disk, but the compressed member expands to a valid NPY array of about 4 GiB.
numpy.load() opens the archive and lists the weights array successfully. When the array is accessed with archive["weights"], NumPy attempts to decompress and materialize the large array, causing inference/evaluation pipelines to hang or exhaust resources.
Files
npz_compressed_npy_dos.npz: PoC model file to upload to Hugging Face.build_and_verify.py: Builds the NPZ file and verifies archive load, array access behavior, and ModelScan result.verify_report.json: Verification output from the local run.
Reproduction
& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-npz-compressed-npy-dos\build_and_verify.py
Expected result:
- NPZ size is about 4.17 MiB.
- ZIP metadata reports
weights.npyhas compressed size about 4.17 MiB and uncompressed size about 4 GiB. numpy.load(path)succeeds and lists["weights"].- Accessing
archive["weights"]times out or exhausts resources.
Impact
An attacker can publish a small NPZ model artifact that appears lightweight during download and archive inspection, but causes denial of service when downstream tooling accesses the contained array. This can affect automated model evaluation, CI/CD model testing, model conversion jobs, or any pipeline that calls numpy.load() on untrusted NPZ model files and then accesses arrays.