| # Security-research PoC — compressed-joblib scanner bypass (picklescan / ModelScan) | |
| Benign PoC for a coordinated disclosure to huntr's Model File Format program. Not malware. | |
| `model.joblib` is a compressed (.joblib) container. Both static scanners feed the RAW compressed bytes to | |
| `pickletools.genops`, which bails at the zlib header before parsing a single opcode — so picklescan reports | |
| a clean, zero-advisory verdict and ModelScan reports "did not scan", while `joblib.load()` transparently | |
| decompresses and unpickles, executing the payload. The payload is harmless: it writes a marker file to the | |
| system temp dir. No exfiltration, no destruction, no network, no self-propagation. | |
| ## Reproduce | |
| ``` | |
| pip install picklescan==1.0.5 modelscan==0.8.8 joblib | |
| picklescan -p model.joblib # -> exit 0, 0 dangerous globals (clean) | |
| modelscan scan model.joblib # -> did not scan / no issues | |
| python -c "import joblib; joblib.load('model.joblib')" # -> marker written = code executed | |
| ``` | |