Open-source keras-model-scan and pickle-model-scan check ML models without loading them

Munim released a free MIT-licensed set of static scanners for ML model files: .keras, .h5, .pkl, .joblib, .pt/.pth/.bin and object-dtype .npy/.npz. The tools only read bytes, never loading or executing a model, and flag dangerous pickle imports, allowlist bypasses and Zip Slip.

• Scanners never load, import or unpickle files — they only read bytes
• pickle-model-scan reports os.system with REDUCE as CRITICAL and catches the STACK_GLOBAL bypass (CVE-2025-71325)
• JSON and SARIF output, a GitHub Action and a --fail-on flag for CI
• Requires only Python 3.8+; lz4 and zstd containers are reported as unscanned