thesecguy/poc-npz-modelscan-bypass

Defensive PoC: NumPy .npz with object dtype -- ProtectAI / HuggingFace pickle scanner bypass

Do not load this file in production. Real ACE payload, kept benign (writes sentinel /tmp/PWNED_BY_NPZ).

What it shows

numpy.savez(path, x=arr_with_object_dtype) and numpy.savez_compressed(...) produce .npz files that start with the ZIP magic PK\x03\x04 and embed one .npy member per array. ProtectAI modelscan classifies the file as a NumPy archive and reports "No issues found"; the embedded pickle inside the .npy member is never opcode-walked. numpy.load(path, allow_pickle=True) materialises the object array and runs __reduce__, executing arbitrary code.

Reproduce

pip install numpy modelscan
modelscan -p data.npz             # No issues found
python3 -c "import numpy as np; np.load('data.npz', allow_pickle=True)['x'][0]"
ls /tmp/PWNED_BY_NPZ              # sentinel

Disclosed via huntr.com.