Security-research PoC — compressed-joblib scanner bypass (picklescan / ModelScan)
Benign PoC for a coordinated disclosure to huntr's Model File Format program. Not malware.
model.joblib is a compressed (.joblib) container. Both static scanners feed the RAW compressed bytes to
pickletools.genops, which bails at the zlib header before parsing a single opcode — so picklescan reports
a clean, zero-advisory verdict and ModelScan reports "did not scan", while joblib.load() transparently
decompresses and unpickles, executing the payload. The payload is harmless: it writes a marker file to the
system temp dir. No exfiltration, no destruction, no network, no self-propagation.
Reproduce
pip install picklescan==1.0.5 modelscan==0.8.8 joblib
picklescan -p model.joblib # -> exit 0, 0 dangerous globals (clean)
modelscan scan model.joblib # -> did not scan / no issues
python -c "import joblib; joblib.load('model.joblib')" # -> marker written = code executed