fickling

What it is and what it does

Fickling provides tools to inspect and validate Python pickle files for malicious content before they are deserialized. It works by hooking into Python's pickle module to intercept and analyze bytecode execution, checking imports against an allowlist of known-safe ML library imports. The package can be used as a library with context managers or global hooks, or as a command-line tool for batch analysis.

The core use case is securing AI/ML environments where untrusted pickle files (including PyTorch model files) may be loaded. Fickling can also decompile pickle bytecode to an AST for manual inspection, trace pickle execution without running malicious code, inject code into pickle files, and identify polyglot files that masquerade as multiple formats. It supports PyTorch formats from v0.1.1 through v1.3 and TorchScript formats v1.0 through v1.4.

Use it for:

• Scan downloaded PyTorch models or pickle files for malicious imports before loading them in production
• Automatically block unsafe pickle deserialization in ML pipelines using global hooks or context managers
• Analyze suspicious pickle files by decompiling them to Python AST for manual code review
• Detect polyglot files that exploit multiple PyTorch or TorchScript format specifications
• Trace pickle bytecode execution without executing embedded malicious code for forensic analysis

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle serializations that detects, analyzes, and can reverse-engineer or create malicious pickle and pickle-based files including PyTorch models.

Yes. Fickling is actively maintained, has no runtime dependencies, supports current Python versions, and fills a genuine security gap in ML workflows where pickle deserialization is a known attack vector. The LGPLv3+ license is permissive for most use cases. Install it if you load pickle or PyTorch files from any untrusted source.

Install

fickling on PyPI

pip install fickling

uv add fickling

poetry add fickling

Installing fickling

Before you install

Installation is straightforward with no runtime dependencies; the package is actively maintained with a recent release and supports Python 3.10 through 3.14. PyTorch support is optional.

License in practice

Fickling is licensed under GNU LGPLv3+, a copyleft license. You may use it in proprietary applications if you link dynamically and provide users with the ability to relink against modified versions, but derivative works of fickling itself must remain open source.

Quickstart

import fickling

# Enable safety checks for all pickle loads
fickling.always_check_safety()

# Or check a single file
try:
    fickling.load("file.pkl")
except fickling.UnsafeFileError as e:
    print(f"Unsafe: {e.info}")

Requires Python 3.10 or later. PyTorch support requires the optional torch dependency.

Verify before relying

• Whether the allowlist of safe ML library imports is kept current with new library releases
• Performance characteristics when analyzing large pickle files or many files in sequence

Package facts

Evidence: fickling-0.1.12-py3-none-any.whl

Tags

More Utilities packages