Kanisia/zip-stored-npy-dos

ZIP Compressed NPY Member Decompression DoS

Target

ZIP model format.

Summary

zip_stored_npy_dos.zip is a small compressed ZIP model artifact that contains a single valid model/weights.npy member. The ZIP file is about 4.17 MiB on disk, but the compressed member expands to a valid NPY array of about 4 GiB.

Archive inspection succeeds and the embedded NPY header is valid. When downstream tooling extracts and loads the member, the process attempts to materialize the large array, causing the worker to hang or exhaust resources.

Files

• zip_stored_npy_dos.zip: PoC model file to upload to Hugging Face.
• build_and_verify.py: Builds the ZIP file and verifies archive inspection, NPY header access, extraction/load behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-zip-stored-npy-dos\build_and_verify.py

Expected result:

• ZIP size is about 4.17 MiB.
• ZIP metadata reports model/weights.npy has compressed size about 4.17 MiB and uncompressed size about 4 GiB.
• The embedded NPY member starts with the valid magic header b'\x93NUMPY'.
• Extracting and loading the embedded array times out or exhausts resources.

Impact

An attacker can publish a small ZIP model artifact that appears lightweight during download and archive inspection, but expands into a very large NPY tensor when downstream tooling extracts and loads the contained array. This can affect automated model evaluation, CI/CD model testing, model conversion jobs, or any pipeline that processes untrusted ZIP model files.