You can deploy this model and start earning money today!

optimus-fulcria/
npz-modelscan-bypass-poc

Name: npz-modelscan-bypass-poc
Availability: InStock

security-research

proof-of-concept

Views

No views yet

NPZ ModelScan Bypass PoC

Security research for Huntr bug bounty program.

This repository demonstrates that malicious NumPy NPZ files with pickle-based code execution payloads completely bypass ModelScan's NumpyUnsafeOpScan scanner on NumPy 2.x.

Root Cause

ModelScan's picklescanner.py (lines 231-232) uses NumPy private APIs that were removed in NumPy 2.0:

np.lib.format._check_version()
np.lib.format._read_array_header()

This causes an AttributeError crash on every .npy file scan, resulting in all numpy model files being marked as "SCAN_NOT_SUPPORTED" with zero issues reported.

Impact

Any malicious NPZ file containing object-dtype arrays with pickle RCE payloads passes ModelScan with zero detected issues.

Files

malicious_model.npz - NPZ file containing:
- weights.npy - benign float32 weights (128x64)
- biases.npy - benign float32 biases (64)
- metadata.npy - object array with pickle RCE payload (subprocess.check_output)

Reproduction

python

import numpy as np
data = np.load("malicious_model.npz", allow_pickle=True)
data['metadata']  # Triggers arbitrary code execution

optimus-fulcria/npz-modelscan-bypass-poc