modelscan-npz-object-pickle-blindspot

modelscan-npz-object-pickle-blindspot

This repository contains a proof of concept for a scanner blind spot in .npz files containing object arrays.

Vulnerability

The included .npz file contains an object array with a harmless pickle payload.

Under NumPy:

• numpy.load(..., allow_pickle=False) blocks object deserialization
• numpy.load(..., allow_pickle=True) followed by access to the stored array triggers the payload

Under modelscan in the tested environment:

• the file returns 0 issues
• but the scanner does not actually analyze the inner .npy member successfully
• instead it errors on a NumPy private API mismatch and leaves the payload effectively unscanned

Primary PoC

The main PoC file is:

• artifacts/payload.npz

The payload is harmless. When the unsafe object-pickle path is reached, it creates a local marker file:

• NPZ_MARKER.txt

Included Files

• artifacts/payload.npz
• artifacts/reproduce_output.txt
• artifacts/sha256sums.txt
• reproduce.py

Tested Environment

• Date tested: July 16, 2026
• Python: 3.13.12
• NumPy: 2.3.5
• modelscan: protectai/modelscan @ 61fcec9c2a37c24c1fb12d84ede30fe248a364bd

Reproduction

1. Verify the included PoC

Run:

python reproduce.py

Expected results:

• allow_pickle=False blocks object array access
• allow_pickle=True plus obj["arr"] triggers the payload
• modelscan returns zero issues
• modelscan also reports an error for the inner .npy member instead of analyzing it

Observed Results

From artifacts/reproduce_output.txt:

• allow_pickle_false_access: ValueError Object arrays cannot be loaded when allow_pickle=False
• allow_pickle_true_array: [0]
• marker_after_allow_pickle_true: True
• modelscan_issue_count: 0
• modelscan_errors: contains a NumPy private API error
• skipped summary includes payload.npz:arr.npy

Impact

This is a practical medium/low-value scanner blind spot for a less-common model format:

• the malicious payload is real and executes on the unsafe object-pickle path
• modelscan produces zero findings
• the actual inner payload is not analyzed successfully in the tested environment

Notes

• This is not a clean silent bypass like the stronger .joblib and .pt findings.
• The value here is that a malicious .npz payload remains effectively undetected under the tested scanner environment.