Model & ML supply-chain security
picklescan is an open-source pickle file scanner from Matthieu Maitre. It is released under the MIT license and is offered as: CLI, Library.
Best for
picklescan is a small MIT-licensed command-line scanner that flags pickle files importing globals on its dangerous list, such as eval. It accepts local files, directories, URLs, zip archives including PyTorch checkpoints, NumPy .npy files and whole Hugging Face repositories, and its exit codes (0 clean, 1 malware, 2 error) make it easy to gate a pipeline. The weakness is the list itself. The repository's own security advisories record repeated bypasses, including three critical ones published on March 2, 2026 for modules missing from the blocklist, so a clean result means no known-bad import was found, not that the file is safe. Fickling takes the opposite approach with an allowlist of safe imports, and ModelScan adds formats beyond pickle. If you rely on picklescan, keep it on the latest release; the README documents the CLI only, with no Python API reference.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L3 Supply chain Model and supply chain | Primary | Check that models, datasets and AI components from outside are what they claim to be and do not run code or hide backdoors when loaded. | Follows its category, Model & ML supply-chain security |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM03 Supply Chain | Scans pickle-based model files, including Hugging Face repositories, for suspicious globals before they are loaded. | Scans Python pickle files and reports flagged globals such as eval imports, with a summary of scanned and infected files; Loads pickles from local files, directories, URLs and zip archives, including PyTorch-style zip files and NumPy .npy files; The --huggingface option scans a model repository on the Hugging Face Hub |
More in Model & ML supply-chain security, ranked within the category by Coverage Score.
OpenAI (Promptfoo)
Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.
Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI
Reviewed
Palo Alto Networks (Protect AI)
Scans saved ML model files for unsafe serialized code before you load them, from a CLI or Python.
Best for: ML and platform teams that want a free scanner to check downloaded or internally produced model files before loading or deploying them
Reviewed
Signs machine learning model files and verifies them later so tampering can be detected.
Best for: Teams that publish or consume models and want a free way to sign model files and check signatures before loading them
Reviewed
Yes. picklescan is released under the MIT license, and the code is on GitHub at mmaitre314/picklescan.
Yes. The README shows picklescan --huggingface followed by a repository name, which scans that model and reports any flagged globals.
The README lists 0 for no malware found, 1 for malware found and 2 for a failed scan.
Yes, and the project says so in public. Its GitHub security advisories list bypasses of the dangerous-globals blocklist, three of them published with critical severity on March 2, 2026. Treat a clean scan as one signal, keep the tool updated, and prefer safetensors or an allowlist approach for files you cannot vouch for.
picklescan is released under the MIT license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
picklescan is offered as: CLI, Library.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for picklescan: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of picklescan: July 1, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with Matthieu Maitre.