---
id: fickling
version: "0.1.12"
license: GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> Everyone is permitted to copy and distribute verbatim copies of this… (full text in the JSON record)
license_treatment: copyleft
maintenance: active
---

# fickling — A static analyzer and interpreter for Python pickle data

License: copyleft · Maintenance: active · Downloads: 993.4K/mo

## What it is and what it does

Fickling provides tools to inspect and validate Python pickle files for malicious content before they are deserialized. It works by hooking into Python's pickle module to intercept and analyze bytecode execution, checking imports against an allowlist of known-safe ML library imports. The package can be used as a library with context managers or global hooks, or as a command-line tool for batch analysis.

The core use case is securing AI/ML environments where untrusted pickle files (including PyTorch model files) may be loaded. Fickling can also decompile pickle bytecode to an AST for manual inspection, trace pickle execution without running malicious code, inject code into pickle files, and identify polyglot files that masquerade as multiple formats. It supports PyTorch formats from v0.1.1 through v1.3 and TorchScript formats v1.0 through v1.4.

Use it for:

- Scan downloaded PyTorch models or pickle files for malicious imports before loading them in production
- Automatically block unsafe pickle deserialization in ML pipelines using global hooks or context managers
- Analyze suspicious pickle files by decompiling them to Python AST for manual code review
- Detect polyglot files that exploit multiple PyTorch or TorchScript format specifications
- Trace pickle bytecode execution without executing embedded malicious code for forensic analysis

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle serializations that detects, analyzes, and can reverse-engineer or create malicious pickle and pickle-based files including PyTorch models.

Yes. Fickling is actively maintained, has no runtime dependencies, supports current Python versions, and fills a genuine security gap in ML workflows where pickle deserialization is a known attack vector. The LGPLv3+ license is permissive for most use cases. Install it if you load pickle or PyTorch files from any untrusted source.

## Install

pip install fickling
uv add fickling
poetry add fickling

## Installing fickling

Before you install: Installation is straightforward with no runtime dependencies; the package is actively maintained with a recent release and supports Python 3.10 through 3.14. PyTorch support is optional.

License in practice: Fickling is licensed under GNU LGPLv3+, a copyleft license. You may use it in proprietary applications if you link dynamically and provide users with the ability to relink against modified versions, but derivative works of fickling itself must remain open source.

Quickstart:

import fickling

# Enable safety checks for all pickle loads
fickling.always_check_safety()

# Or check a single file
try:
    fickling.load("file.pkl")
except fickling.UnsafeFileError as e:
    print(f"Unsafe: {e.info}")

Requires Python 3.10 or later. PyTorch support requires the optional torch dependency.

Verify before relying:

- Whether the allowlist of safe ML library imports is kept current with new library releases
- Performance characteristics when analyzing large pickle files or many files in sequence

## Package facts

- License: GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> Everyone is permitted to copy and distribute verbatim copies of this… (full text in the JSON record) (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 993.4K/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

pickle security analysis, detect malicious pickle files, pytorch model safety checking, pickle decompiler, pickle bytecode analyzer, pickle-security, ml-safety, bytecode-analysis

[View on SkillFed](https://skillfed.io/packages/fickling) · [View on PyPI](https://pypi.org/project/fickling/)