Both picklescan 1.0.4 and modelscan 0.8.8 skip .sav files entirely. This extension is widely used to save scikit-learn/joblib models and is byte-for-byte identical to .pkl. Neither scanner warns the user.
1pip install picklescan modelscan scikit-learn joblib
2picklescan -p . # Scanned files: 0
3modelscan -p . # No issues found
4python3 -c "import joblib; joblib.load('malicious_model.sav')"
.sav is a common convention for sklearn model files -- used in Microsoft Azure ML docs and thousands of public repos. The files are plain pickle (same magic bytes as .pkl). The extension filter in both scanners does not include .sav so the files are silently skipped.
Submitted to huntr MFV program for responsible disclosure.
