Scan a Python pickle, PyTorch (.pt / .pth / .ckpt), joblib or NumPy model file for malware — without ever unpickling it. Pure static opcode analysis. Your file is scanned in memory and never stored or executed.
🔒 100% static. The file is disassembled with pickletools.genops — no pickle.load, no code runs. Safe for actively-malicious files.
🛡️ ML Supply-Chain Hardening Kit — $15
For teams shipping models to prod. Everything to stop malicious pickles at the door:
✅ Drop-in CI GitHub Action that blocks unsafe model artifacts on every PR
✅ Hardened allowlist unpickler (Python) — the safe way to load untrusted models
✅ The gadget catalog: 40+ load-time file-write / SSRF / RCE gadgets, incl. ones picklescan & modelscan miss
Pickle files execute arbitrary code the moment you load them. Models from HuggingFace, Kaggle, or a colleague are untrusted code.
PickleCheck reads the opcode stream statically and flags every GLOBAL/STACK_GLOBAL that reaches a dangerous callable — including stdlib file-write and network gadgets that mainstream scanners rate only "suspicious".
Prefer safetensors for weights. Use PickleCheck for the legacy .pt/.pkl you can't avoid.
Static heuristic analysis — a clean result is not a security guarantee. No file is stored.