scanner-bypass-npy-int-desync

picklescan & ModelScan bypass: object-dtype .npy INT-opcode desync (non-pickle container)

Benign security-research PoC for the huntr Model File Format program. Payload only writes a nonce marker (echo) — no real harm.

Vulnerability

A valid object-dtype NumPy .npy embeds a pickle stream that ModelScan scans via its numpy-specific path (NumpyUnsafeOpScan) and picklescan via its numpy handling. The embedded pickle carries the INT-opcode desync prefix (I0x10\n): genops parses base-10 and aborts before the payload, while numpy.load(allow_pickle=True) parses 0x10 base-0 and executes the reduce payload. Defeats the numpy-SPECIFIC defence that CATCHES a plain malicious object .npy — a distinct code path and format ($1500 non-pickle tier).

Measured (2026-07-24): picklescan 1.0.5 exit 0; ModelScan 0.8.8 no issue; numpy.load fires the benign marker.

Reproduce

import numpy as np
np.load("model.npy", allow_pickle=True)   # fires the benign marker at load

picklescan -p model.npy   # exit 0
modelscan -p model.npy     # no issue