Free IDE extension for risk-free vibe coding — keep secrets out of AI.
Model supply-chain security
A single torch.load() on an untrusted file can run arbitrary code. SoterAI scans model artifacts for malicious serialization, verifies integrity and provenance, and produces an AI-BOM — with pure static analysis that never executes the model.
Most distributed models (Huggingface pytorch_model.bin, checkpoints, joblib files) are Python pickles. Pickle is a stack VM that can import and call any function on load — the classic payload is GLOBAL os system + REDUCE. SoterAI parses that opcode stream and refuses to let it surprise you in production.
Walks the pickle opcode stream behind PyTorch .pt/.bin, joblib, and numpy object arrays — flagging os.system, eval/exec, subprocess, and other code-execution imports via GLOBAL/STACK_GLOBAL + REDUCE.
Unwraps PyTorch zip archives (stored + deflate), validates safetensors headers, and recognizes GGUF, ONNX, HDF5/Keras, and numpy — with the right risk model for each.
SHA-256 every artifact, compare against an expected digest, and match against a known-good allowlist. A mismatch is treated as tampering.
Verifies SLSA / in-toto (DSSE) and Sigstore-style attestations — including the most-skipped check: does the attestation's subject digest actually bind THIS artifact?
Generate a signed CycloneDX 1.6 AI Bill of Materials covering models, providers, prompts, and tools — exportable for compliance and SIEM.
100% static analysis in TypeScript. No Python, no model load, no sandbox escape surface. Runs inline, in CI, or offline.
Magic bytes + extension → pickle, torch-zip, safetensors, gguf, onnx, h5, npy.
Unwrap zip entries (inflate data.pkl) or locate embedded pickle regions.
Opcode-walk the pickle; capture every imported global; classify severity.
SHA-256 integrity, known-good allowlist, and provenance subject-digest binding.
SAFE · UNVERIFIED · SUSPICIOUS · MALICIOUS with a 0–100 risk score and findings.
| Format | Executes code on load? | SoterAI scan |
|---|---|---|
| safetensors | No | Header validation — safest format |
| PyTorch .pt/.bin (zip) | Yes (pickle) | Unwrap + opcode scan |
| .pkl / joblib | Yes (pickle) | Opcode scan |
| numpy .npy (object) | Yes (pickle) | Embedded pickle scan |
| HDF5 / Keras .h5 | Possible (Lambda) | Flagged for review |
| GGUF / ONNX | No | Recognized data-only |
Drag a model file into the scanner, or call the API in CI before every deploy.
