1.2.3

Big-endian GGUF false positive fixed (now MFV-GGUF-004 INFO). Plain .tar archives now scanned for traversal/symlink (MFV-ARCHIVE-001/002), with a renamed-pickle content-sniff fallthrough. See CHANGELOG.md.

Hayward 1.2.2

Fixed: GGUF version 1 false positive. v1 stores its header counts as 32-bit fields (v2/v3 use 64-bit), so a valid v1 model was misread and flagged MFV-GGUF-005 at HIGH. v1 is now recognised as a coverage gap (MFV-GGUF-004, INFO), not a verdict. Surfaced by a comparative benchmark against a real public model.

Hayward 1.2.1

Shortens the GitHub Action's Marketplace description to under 125 characters (a Marketplace requirement). No scanner change: the code is identical to 1.2.0.

Hayward 1.2.0

Archive-safety detections and a reproducible accuracy measurement.

Added

• MFV-ARCHIVE-001 (MEDIUM, CWE-22): an archive member whose name is unsafe as an extraction path (a .. segment, absolute, Windows drive, UNC, or NUL/newline), across the torch zip (.pt), the nested zip in a .mar, and the tar-based .nemo. .npz was already covered by MFV-NPZ-001.
• MFV-ARCHIVE-002 (MEDIUM, CWE-22/59): an archive member that is a symlink or hard link whose target escapes the extraction directory. On extraction the loader creates the link, then a later member written through it lands wherever it points (the classic tar/zip symlink attack, CVE-2007-4559 family).

Fixed

• Deny uuid._get_command_stdout and uuid._popen, subprocess gadgets (GHSA-g38g-8gr9-h9xp) that were only surfaced at INFO. The uuid module itself stays allowed. Found by a reproducible re-measurement of 1.1.0.

Docs

• docs/accuracy.md now leads with a reproducible 1.1.0 detection measurement against the public picklescan corpus, with the exact commands.

CI

• Concurrency-cancel and per-job timeouts to cap runner spend.

Hayward 1.1.0

A hardening and feature release.

Added

• HuggingFace / transformers JSON config RCE detection: auto_map, trust_remote_code, and Jinja chat_template injection (MFV-HF-001/002); executable Python source inside torch archives (MFV-TORCH-001); .ptl.
• SARIF and CycloneDX output, plus a composite GitHub Action for code scanning.
• --baseline (fail only on new findings), an auditable hash-keyed --allowlist, per-rule --policy severity overrides, a content-hash --cache, and --check-signatures (MFV-SIG-001).
• Parallel scanning (--jobs), --exclude, --max-size, --progress/--verbose/--quiet, multiple targets, a reproducible Docker image, and an accuracy harness.

Fixed

• Scanner self-DoS hardening and a per-file exception firewall; evasion gaps closed (protocol-0/1 resync, two-level embedded pickles, GGUF metadata past the scan window, the zip lied-size gate, and the Keras decoy).

Removed

• The unused ModelFileFinding export (why this is a minor bump).

See CHANGELOG.md for the full list.

v1.0.1

Three silent-failure fixes. In each case the scanner returned no findings and no coverage finding, which is the one outcome it is built to avoid.

Fixed

• A malicious pickle under an unmapped extension was skipped silently. A file named directly is now identified by its content whatever it is called, including with no extension at all. Found using Hugging Face's own canary repo mcpotato/42-eicar-street, whose danger.dat returned nothing while the identical bytes named danger.pkl returned CRITICAL. (#4)

• A pickle stream truncated before its STOP opcode scanned clean, so a payload past the cut was invisible and a partially downloaded checkpoint was indistinguishable from one that had been read. It now reports MFV-SKIP-003. (#3)

• Duplicate .npz member names went undetected on Windows. zipfile rewrites a backslash to a forward slash while reading the central directory, so two members differing only by separator arrived identical and MFV-NPZ-001 never fired. The same archive was flagged correctly on Linux and macOS. (#2)

Also

• A browser demo that runs the same scanner in WebAssembly, so a file you drop on it never leaves your machine: https://huggingface.co/spaces/hedgerow-dev/hayward
• docs/coverage.md records a measured limit in truncation detection: zero occurrences across 286 real Hub models and 395 files from the picklescan, MalHug and PickleCloak corpora.

391 tests, no network required.

Hayward 1.0.0

First release. Security scanner for machine-learning model files: know whether a checkpoint will run code on your machine, before you load it.

See CHANGELOG.md for the full release notes.

pip install hayward