GuardDog - ZIP parser differential hides a malicious payload from the scanner

A crafted wheel sets the end-of-central-directory record to report zero entries. Python's zipfile then reads the archive as empty and the scanner reports no indicators, while the installer still unpacks the real payload from the local file headers. Fixed by walking the local file headers directly and rejecting any archive whose header count exceeds what zipfile reports. Submitted as PR #790.

A malicious package passes a supply-chain scan with a clean report while still installing its payload.