Malicious .npy file achieves Arbitrary Code Execution via np.load(allow_pickle=True), while bypassing both picklescan 1.0.4 and modelscan 0.8.8.

NPY files with dtype=object contain pickled data. Our payload uses marshal.loads + types.FunctionType + importlib.import_module chain. All three globals are Suspicious (not Dangerous) in picklescan, and absent from modelscan unsafe_globals.

Versions: numpy 2.4.2, picklescan 1.0.4, modelscan 0.8.8, Python 3.12