Do not load this file in production. Real ACE payload, kept benign (writes sentinel /tmp/PWNED_BY_NPZ).

numpy.savez(path, x=arr_with_object_dtype) and numpy.savez_compressed(...) produce .npz files that start with the ZIP magic PK\x03\x04 and embed one .npy member per array. ProtectAI modelscan classifies the file as a NumPy archive and reports "No issues found"; the embedded pickle inside the .npy member is never opcode-walked. numpy.load(path, allow_pickle=True) materialises the object array and runs __reduce__, executing arbitrary code.

Disclosed via huntr.com.