| license: apache-2.0 | |
| tags: [security-research, huntr, model-file-security, scanner-bypass, numpy] | |
| # picklescan & ModelScan bypass: object-dtype .npy INT-opcode desync (non-pickle container) | |
| Benign security-research PoC for the huntr Model File Format program. Payload only writes a nonce marker (echo) — no real harm. | |
| ## Vulnerability | |
| A valid object-dtype NumPy .npy embeds a pickle stream that ModelScan scans via its numpy-specific path (NumpyUnsafeOpScan) and picklescan via its numpy handling. The embedded pickle carries the INT-opcode desync prefix (`I0x10\n`): genops parses base-10 and aborts before the payload, while numpy.load(allow_pickle=True) parses `0x10` base-0 and executes the __reduce__ payload. Defeats the numpy-SPECIFIC defence that CATCHES a plain malicious object .npy — a distinct code path and format ($1500 non-pickle tier). | |
| ## Measured (2026-07-24): picklescan 1.0.5 exit 0; ModelScan 0.8.8 no issue; numpy.load fires the benign marker. | |
| ## Reproduce | |
| ```python | |
| import numpy as np | |
| np.load("model.npy", allow_pickle=True) # fires the benign marker at load | |
| ``` | |
| ```bash | |
| picklescan -p model.npy # exit 0 | |
| modelscan -p model.npy # no issue | |
| ``` | |