mlscan 0.1.0

Title

mlscan 0.1.0

Description (copy everything below)

First public release of mlscan — a static ML supply-chain scanner for Hugging Face and local model artifacts. Never executes what it inspects. Stdlib-only core.

## Install

```bash
pip install mlsupplyscan
mlscan --version

CLI: mlscan (alias: mlsupplyscan)

What's included

• Pickle / torch RCE detection (stack + memo simulation, appended streams, compressed wrappers)
• Zip Slip, safetensors checks, object-dtype .npy/.npz, Keras, ONNX/TF heuristics, GGUF
• auto_map / trust_remote_code, AST scan of bundled Python, notebooks, chat-template Jinja escapes
• Hub typosquatting + optional --online reputation / remote pickle range-read
• Reports: text, JSON, SARIF, HTML, CycloneDX; CI exit codes; --baseline / --policy

Quick start

mlscan scan ./model-dir
mlscan hub org/model --online
mlscan explain suspicious.pkl
mlscan scan ./model -f html -o report.html

Requires Python 3.10+.

• Docs: https://github.com/ashray-00/mlscan#readme
• PyPI: https://pypi.org/project/mlsupplyscan/
• Limitations: LIMITATIONS.md / mlscan limitations