PickleScan ZIP CRC Bypass Advisory

PickleScan often sits in the safety path for AI model ingestion. A scanner bypass matters because teams may treat a clean scan as permission to load a model archive, but a repository dependency match is still version evidence rather than proof that untrusted models reach production.

The repo check looks for the PyPI `picklescan` package in Python dependency manifests and lockfiles. Exact lockfile pins produce the strongest signal; broader manifest ranges are reported when they clearly allow versions before 0.0.31.

If an affected PickleScan runtime scans untrusted ZIP, PyTorch, or pickle-containing archives and the surrounding workflow ignores scan errors, malicious payloads may avoid detection before a model is loaded. A repo match should drive dependency remediation and model-ingestion review before anyone treats the issue as confirmed runtime code execution.

Upgrade `picklescan` to 0.0.31 or newer, regenerate the active Python lockfile, and rebuild every CI, model-ingestion, training, inference, notebook, worker, or security-scanning runtime that uses it. Make scan errors fail closed, keep model artifacts provenance-checked, and use only benign archive/model smoke tests for verification.