# Security-research PoC — compressed-joblib scanner bypass (picklescan / ModelScan)

Benign PoC for a coordinated disclosure to huntr's Model File Format program. Not malware.

`model.joblib` is a compressed (.joblib) container. Both static scanners feed the RAW compressed bytes to
`pickletools.genops`, which bails at the zlib header before parsing a single opcode — so picklescan reports
a clean, zero-advisory verdict and ModelScan reports "did not scan", while `joblib.load()` transparently
decompresses and unpickles, executing the payload. The payload is harmless: it writes a marker file to the
system temp dir. No exfiltration, no destruction, no network, no self-propagation.

## Reproduce
```
pip install picklescan==1.0.5 modelscan==0.8.8 joblib
picklescan -p model.joblib     # -> exit 0, 0 dangerous globals (clean)
modelscan scan model.joblib    # -> did not scan / no issues
python -c "import joblib; joblib.load('model.joblib')"   # -> marker written = code executed
```