picklescan

What it is and what it does

Picklescan is a command-line security tool that inspects Python Pickle files and related serialized formats (like PyTorch models) to identify dangerous operations before you load them. Pickle's design allows arbitrary code execution during deserialization, making untrusted pickles a significant security risk in machine learning workflows. The scanner reports specific dangerous globals and operations it finds, using exit codes compatible with security scanning tools like ClamAV.

It works with local files, directories, remote URLs, and zip archives (common in PyTorch model distribution). You can filter scans by file patterns and directory traversal rules. The tool has no runtime dependencies and runs as a standalone CLI, making it easy to integrate into CI/CD pipelines or pre-download security checks for models from sources like Hugging Face.

Use it for:

• Verify downloaded PyTorch or other ML models from Hugging Face before loading them in your training pipeline.
• Scan model directories in CI/CD to block commits or deployments of pickles with detected dangerous operations.
• Audit local pickle files or model repositories for suspicious code patterns before sharing or using them.
• Integrate into model download workflows to automatically check remote URLs for malicious payloads.
• Screen .npy numpy files alongside pickles when auditing scientific data or model checkpoints.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scans Python Pickle files and related serialized model formats to detect suspicious or malicious code execution patterns before loading them.

Yes. If you work with untrusted or community-sourced pickle files—especially ML models—this tool fills a real security gap with zero installation friction and active maintenance. No dependencies, straightforward CLI, and clear exit codes make it suitable for both manual inspection and automation. Install it.

Install

picklescan on PyPI

pip install picklescan

uv add picklescan

poetry add picklescan

Installing picklescan

Before you install

Low friction: pure Python wheel with no runtime dependencies. Active maintenance with a recent release 44 days ago and steady repository activity.

License in practice

MIT license permits unrestricted use, modification, and distribution with minimal legal friction.

Quickstart

pip install picklescan
picklescan --path model.pkl
# or scan from Hugging Face:
picklescan --huggingface username/model-name

Requires Python 3.11 or later. Optional: install numpy to scan .npy files.

Verify before relying

• Effectiveness of detection heuristics against novel or obfuscated pickle exploits remains unquantified.
• Performance characteristics when scanning very large model files or directories with thousands of files.

Package facts

Evidence: picklescan-1.0.5-py3-none-any.whl

Tags

More Security packages