scanner-bypass-compressed-joblib-poc

Security-research PoC — compressed-joblib scanner bypass (picklescan / ModelScan)

Benign PoC for a coordinated disclosure to huntr's Model File Format program. Not malware.

model.joblib is a compressed (.joblib) container. Both static scanners feed the RAW compressed bytes to pickletools.genops, which bails at the zlib header before parsing a single opcode — so picklescan reports a clean, zero-advisory verdict and ModelScan reports "did not scan", while joblib.load() transparently decompresses and unpickles, executing the payload. The payload is harmless: it writes a marker file to the system temp dir. No exfiltration, no destruction, no network, no self-propagation.

Reproduce

pip install picklescan==1.0.5 modelscan==0.8.8 joblib
picklescan -p model.joblib     # -> exit 0, 0 dangerous globals (clean)
modelscan scan model.joblib    # -> did not scan / no issues
python -c "import joblib; joblib.load('model.joblib')"   # -> marker written = code executed