picklescan versions before 0.0.34 do not detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. This allows attackers to craft malicious pickle payloads that evade detection and execute arbitrary code upon loading with pickle.load().