aisbom

Static security scanner for ML model files — detects pickle bombs, Keras Lambda RCE and GGUF template injection, and generates CycloneDX / SPDX AI-BOMs (AIBOM) as EU AI Act, CRA and FDA §524B evidence.

Explore on GitHub Read Hacker News discussions

2Distinct people

3Mentions

0Explicit recommenders

83GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by hour3 dated mentions

Observed mentions: 2025-12-16 15:55:45 UTC to 2025-12-16 16:45:39 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Dec 16, 15:00	2025-12-16 15:00:00 UTC	2025-12-16 16:00:00 UTC	2	1	1
Dec 16, 16:00	2025-12-16 16:00:00 UTC	2025-12-16 17:00:00 UTC	1	0	1

What Hacker News says

3 sources

woodruffw·Dec 16, 2025

The checks here seem pretty minimal[1]. I'd recommend taking a look at fickling (FD: former employer) for a more general approach to pickle decompilation/analysis[2]. [1]: https://github.com/Lab700xOrg/aisbom/blob/main/aisbom/safety... [2]: https://github.com/trailofbits/fickling

In AIsbom – open-source CLI to detect "Pickle Bombs" in PyTorch models

lab700xdev·Dec 16, 2025Submission

AIsbom – open-source CLI to detect "Pickle Bombs" in PyTorch models

52 points · Open discussion

lab700xdev·Dec 16, 2025

Hi HN, I’ve been working with ML infrastructure for a while and realized there’s a gap in the security posture: we scan our requirements.txt for vulnerabilities, but blindly trust the 5GB binary model files (.pt) we download from Hugging Face. Most developers don't realize that standard PyTorch files are just Zip archives containing Python Pickle bytecode. When you run torch.load(), the unpickler executes that bytecode. This allows for arbitrary code execution (RCE) inside the model file itself - what security researchers call a "Pickle Bomb." I built AIsbom (AI Software Bill of Materials) to solve this without needing a full sandbox. How it works: 1. It inspects the binary structure of artifacts (PyTorch, Pickle, Safetensors) without loading weights into RAM. 2. For PyTorch/Pickles, it uses static analysis (via pickletools) to disassembl

Read the rest

e the opcode stream. 3. It looks for GLOBAL or STACK_GLOBAL instructions referencing dangerous modules like os.system, subprocess, or socket. 4. It outputs a CycloneDX v1.6 JSON SBOM compatible with enterprise tools like Dependency-Track. 5. It also parses .safetensors headers to flag "Non-Commercial" (CC-BY-NC) licenses, which often slip into production undetected. It’s open source (Apache 2.0) and written in Python/Typer. Repo: https://github.com/Lab700xOrg/aisbom Live Demo (Web Viewer): https://aisbom.io Why I built a scanner? https://dev.to/labdev_c81554ba3d4ae28317/pytorch-models-are-... I’d love feedback on the detection logic (specifically safety.py) or if anyone has edge cases of weird Pickle protocols that break the disassembler.

In AIsbom – open-source CLI to detect "Pickle Bombs" in PyTorch models