{"as_of":"2026-08-09T07:18:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:8a41bcb6e981e21f6c4940c68f73d7d52a5515e4412ed0bdc1e2bd44d5bb18d7","coverage":[{"denominator":92,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":92,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T14:47:42.002141Z","state":"measured"},{"denominator":94,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":94,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T11:18:12.942538Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.06662","snapshot_observed_at":"2026-08-04T11:18:12.942538Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.08609","last_updated":"2026-05-24T16:38:01Z","snapshot_observed_at":"2026-08-06T08:21:36.313001Z","submitted_at":"2025-10-07T14:37:03Z","title":"Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-04T11:18:12.942538Z"},"links":{"cited_paper":"/paper/2502.06662","citing_paper":"/paper/2510.08609"},"observation_digest":"sha256:668c77718d569104fca6942e7ba02e24fd1d37dc4c946d2e4f349f2f5cf623f7","observation_id":"1a97e9f0-a892-46fd-a680-b3a92a6956d3","resolution":{"observed_at":"2026-08-04T11:18:12.942538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.06662","snapshot_observed_at":"2026-08-02T02:11:22.936754Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.936754Z"},"links":{"cited_paper":"/paper/2502.06662","citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:1e0a8d7eee664acadec6fc9d375f6d419efdeea9bbfe88a5bda95127dd7276e5","observation_id":"770379e0-39b4-4c5e-b3d7-42268f607f22","resolution":{"observed_at":"2026-08-02T02:11:22.936754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2502.06662/citation-record","integrity":"/paper/2502.06662/integrity","json":"/paper/2502.06662/citation-record.json","paper":"/paper/2502.06662"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.705065Z","title":null,"venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.705065Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:465ac7c6c83ad32acf1353b226ce0a3f4c77c3cba2a08d4f1bb9db2312d2a184","observation_id":"5f84f608-cc15-4c68-bb1a-1c7149e95fa4","resolution":{"observed_at":"2026-08-08T14:47:41.705065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.671718Z","title":"https://doi.org/10.1109/MSR52588.2021.00037 Chris Bogart, Christian Kästner, James D","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.671718Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c9edab69e172e8f04cc56de489afb1859bcb5d6b00b5518b25855ef31e2a80a3","observation_id":"55d628c7-4f85-425e-86c5-367c777e5efc","resolution":{"observed_at":"2026-08-08T14:47:41.671718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.675555Z","title":"ACM Trans","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.675555Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8efd1a1f329b2b1f1de9f705d953cdfcff7d9dd13040cf81dc72c383998352d9","observation_id":"3f55bf83-a250-441c-a6dc-4c461e550d10","resolution":{"observed_at":"2026-08-08T14:47:41.675555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.693288Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.693288Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a646dceedf6613a8f1bdcc1f058e9a762aa57d6c2beff9767dbef4216015f486","observation_id":"be6d0158-7632-489d-a79d-3d4ea5062697","resolution":{"observed_at":"2026-08-08T14:47:41.693288Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.701377Z","title":"In 37th IEEE/ACM International Conference on Software Engineering, ICSE 2015, Florence, Italy, May 16-24, 2015, Volume","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.701377Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:35bee50e9273db9800d3c4c967bb6f54281d3f688831180462d04edaec603959","observation_id":"d38489d8-b673-45ec-be7c-7a8ab7e27332","resolution":{"observed_at":"2026-08-08T14:47:41.701377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.717307Z","title":"Retrieved December 11, 2023 from https://crashoverride.com/blog/dependency-pinning-only-works-if-you-actually-review-the-updates Erik DeBill","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.717307Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:10345f4cf1a07243454ed442582413a1dd7b3d2c60bed9a318280dde5c0b944f","observation_id":"1d4088a3-9085-4811-84b1-4d4df995aad5","resolution":{"observed_at":"2026-08-08T14:47:41.717307Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.721413Z","title":"Retrieved May 23, 2024 from http://www.modulecounts.com/ Alexandre Decan and Tom Mens","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.721413Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:533d18e44424436a9a100ad6080b97631989535f9dc554d3e45802ce39fba32f","observation_id":"ca4f89e5-abf4-4bae-9e7c-d01634f72327","resolution":{"observed_at":"2026-08-08T14:47:41.721413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.725218Z","title":"Software Eng","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.725218Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a3b6ca7cbe6657d272c6dc1b36a951500647afb07e7f4a5826998d49d64b5072","observation_id":"5a0b1e96-2899-40ba-b9dd-87876e89c03d","resolution":{"observed_at":"2026-08-08T14:47:41.725218Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.736391Z","title":"In Proceedings of the 16th International Conference on Mining Software Repositories, MSR 2019, 26-27 May 2019, Montreal, Canada","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.736391Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:77e50e7425693aad808760f2bf348d4b195f323a32379a6ffc0d3641aefab8fa","observation_id":"8886afe1-ca8c-4a12-b49f-c13b75b2ceec","resolution":{"observed_at":"2026-08-08T14:47:41.736391Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.743507Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.743507Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1c5f12ca81bfdf7466cdf097c52b65ae20b7ed62183cb477fc68478319cfbf10","observation_id":"d4740adb-f240-475b-aa79-eb308dd75106","resolution":{"observed_at":"2026-08-08T14:47:41.743507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.747476Z","title":"In ISSTA ’20: 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, USA, July 18-22, 2020","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.747476Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d30c5ab3f2484b8898e28d427ec24f0bee33b33c22043cccf71da746f78744e7","observation_id":"90d803f0-1fb4-4af3-82f8-b54f6c4297d5","resolution":{"observed_at":"2026-08-08T14:47:41.747476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.307856Z","title":"login Usenix Mag","venue":null,"work_id":"33826523-d9e9-4bf2-bbe2-4e4b3e73d6c0","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.751370Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ebe83410ab0b41a9b34647260950b6888e7925eab90d8d02f23f3870dab21b98","observation_id":"c18c0203-fe6d-48e2-8d19-1adaeefd572d","resolution":{"observed_at":"2026-08-08T14:47:47.312726Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.279820Z","title":"Retrieved April 21, 2024 from https://github.com/advisories Google","venue":null,"work_id":"3435855d-c379-461e-bdca-a9b8c570b6f1","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.762788Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:154a4cd8b895399cc236f9f0c0c9558ef896b0f482a49748276b81474544867f","observation_id":"196a584a-3d4c-442a-9188-923f0c89fa13","resolution":{"observed_at":"2026-08-08T14:47:47.284091Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.269341Z","title":"Retrieved September 8, 2024 from https://cloud.google.com/security/products/ assured-open-source-software Hacker News","venue":null,"work_id":"9f1634e8-672c-4280-b5d8-5e5592f66de4","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.766283Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:03c3c932eab1625d5bbae2aa354f051b65451bd406e444a3e61406c7f5f85fdc","observation_id":"21394ee7-e446-4ed2-a3dc-170633eedc49","resolution":{"observed_at":"2026-08-08T14:47:47.273547Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.259288Z","title":"Retrieved December 11, 2023 from https://news.ycombinator.com/item?id=14759329 Hacker News","venue":null,"work_id":"9928ec5f-321b-44cf-8fe0-06b658e1c30c","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.769527Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:e275afccb7ec166a3cb0ce6ef6b2de97897ec089d49f2a13e745ddb3bbc6bd12","observation_id":"07e1a75b-021d-4357-b1f3-cfdc16269a80","resolution":{"observed_at":"2026-08-08T14:47:47.263235Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.248535Z","title":"Retrieved December 13, 2023 from https://news","venue":null,"work_id":"10ae5214-cce9-4b8d-8cdd-9881e5f3da60","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.773090Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bd53aa4d8e2ccb10b57daa03875ebbbceccf0c8910140e1d94739b31489fe616","observation_id":"a12fe0da-f2a9-4506-9a1d-98e4a4cd87df","resolution":{"observed_at":"2026-08-08T14:47:47.252350Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.776362Z","title":"In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.776362Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3ba3f384b4abef2bd5489e9c40e0940c9d1558c08621454da5a346302fad0eab","observation_id":"23f0729c-c62d-41ad-bd51-c0a71007498e","resolution":{"observed_at":"2026-08-08T14:47:41.776362Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2023.32781","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.416622Z","title":"IEEE Trans","venue":null,"work_id":"253d3338-5bd7-424f-812e-edf352fc7580","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.780201Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1cd0019069dac2268a030bbfcf18eb09bd031dc9e6d67d9c67544020f3acc73d","observation_id":"859f7a2f-2f94-4a38-a0c7-6cac63199fdd","resolution":{"observed_at":"2026-08-08T14:47:46.422456Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.238153Z","title":null,"venue":null,"work_id":"233755d6-6c71-488a-b94e-cfcaf7baabe7","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.784809Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d4279355d7b04fcbcab0e2d6d1dd00982d3fd4504f719ea0dc2af8dd72a842aa","observation_id":"4bbed8ab-84c7-45bf-9311-3569e21fa9ac","resolution":{"observed_at":"2026-08-08T14:47:47.241865Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1908.04856","last_updated":"2019-08-13T20:59:33Z","snapshot_observed_at":"2026-08-03T06:58:20.401333Z","submitted_at":"2019-08-13T20:59:33Z","title":"Exploit Prediction Scoring System (EPSS)","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.04856","snapshot_observed_at":"2026-08-08T14:47:41.788915Z","title":"CoRR abs/1908.04856 (2019)","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.788915Z"},"links":{"cited_paper":"/paper/1908.04856","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:799d52bc1127e1e37a7d2ea21ab9fde8830c88b5a2c8c6b4b42b4326d4205030","observation_id":"d40569ff-8708-4d37-9959-ce9f79e86575","resolution":{"observed_at":"2026-08-08T14:47:41.788915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.793741Z","title":"IEEE Trans","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.793741Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5644c92f0366e95925298f1700be4042a9dc66c0f2d9511b9ef1b5cb8f326fdf","observation_id":"2cde4814-9ecd-4f22-8988-4c61d25b96bb","resolution":{"observed_at":"2026-08-08T14:47:41.793741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.797776Z","title":"ACM Trans","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.797776Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:233117e9f1eaf682ad3991c3e7f7cd2509e32adbb1263f7c33ef7936e00b77ba","observation_id":"1e407a8d-532f-428c-91a6-8fc5d1deff36","resolution":{"observed_at":"2026-08-08T14:47:41.797776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.227122Z","title":"In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, Seattle, W A, USA, July 17-21,","venue":null,"work_id":"1dffe6e1-575d-4ceb-bcad-93e41b9f3133","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.801334Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:7cd995f0bf704e3a777d32262041b0acb3af30872118985a40ee3f112f267105","observation_id":"36f372f6-1cf3-4141-a2c2-d23b27ea625e","resolution":{"observed_at":"2026-08-08T14:47:47.231391Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.805408Z","title":"https://doi.org/10.1145/3597926.3598147 Dezhen Kong, Jiakun Liu, Lingfeng Bao, and David Lo","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.805408Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c11c281c47dec1d8598480fe3c35343309048513cf24f5c6c6dfbd12959c14fa","observation_id":"8606aeba-2443-41f4-88f2-12029d620fa9","resolution":{"observed_at":"2026-08-08T14:47:41.805408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.14431","last_updated":"2024-10-14T13:28:59Z","snapshot_observed_at":"2026-07-06T19:06:06.424850Z","submitted_at":"2024-08-26T17:18:38Z","title":"Towards Better Comprehension of Breaking Changes in the NPM Ecosystem","version":2},"cited_work":{"arxiv_id":"2408.14431","doi":null,"metadata_source":"pith","pith_arxiv_id":"2408.14431","snapshot_observed_at":"2026-08-08T14:47:46.070167Z","title":"Towards Better Comprehension of Breaking Changes in the NPM Ecosystem","venue":"cs.SE","work_id":"b0192d16-ebf3-4dee-9e1e-62bbe3a9f258","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.809215Z"},"links":{"cited_paper":"/paper/2408.14431","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:03e4b16b2921eb68e257f87b5601ff0738ccbe8b1f963dd6ef14d09214b4f034","observation_id":"caa19653-54b7-40e7-80d8-901a6ac86d1c","resolution":{"observed_at":"2026-08-08T14:47:46.074635Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.813093Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.813093Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1a5f61404b8ba120876cd0744f0b993d03801b9aed7c2f0f750acc35a6028388","observation_id":"58708245-d033-487b-96b0-c6e96a4c5c0e","resolution":{"observed_at":"2026-08-08T14:47:41.813093Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.216055Z","title":"In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, Proc","venue":null,"work_id":"60c71776-1a9e-425f-9d3b-964b8cc33091","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.816792Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b2f9c934a22632c32151543ab4d0ffc238c63ef7029f076f5aab8cd80f8d1eb4","observation_id":"3288c5b4-5f2e-40c0-beef-d31e937ac696","resolution":{"observed_at":"2026-08-08T14:47:47.220238Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.820581Z","title":"https://doi.org/10.1109/SP46215.2023.10179304 Jasmine Latendresse, Suhaib Mujahid, Diego Elias Costa, and Emad Shihab","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.820581Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bd54bfece7ec6cef827f789fb3abc57a59f04c9b6d8315cf9c568d3d753719a6","observation_id":"da2ca4b8-bbaf-4cb0-a585-50f8d65726b9","resolution":{"observed_at":"2026-08-08T14:47:41.820581Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.824112Z","title":"In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.824112Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:10a09fbef764b9d8c07657fc8dafcaa290973592dc0f022ba90ad55d0991084f","observation_id":"b5b388c5-d80c-4f26-a69f-c8afa02a6f5e","resolution":{"observed_at":"2026-08-08T14:47:41.824112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.204544Z","title":"Retrieved December 13, 2023 from https://maxleiter.com/blog/pin- dependencies Chengwei Liu, Sen Chen, Lingling Fan, Bihuan Chen, Yang Liu, and Xin Peng","venue":null,"work_id":"b07c3b2b-ae1f-47a4-a1f2-b7a20a7dafa4","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.827697Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d4ff147ccb7692c4888957d9f41d23f107868f186f208180ac068105d11e79f0","observation_id":"74cb0e93-17af-4511-8730-b6950e180821","resolution":{"observed_at":"2026-08-08T14:47:47.208559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.194411Z","title":"Retrieved December 13, 2023 from https://www.lucidchart","venue":null,"work_id":"ba26ef4e-ee91-4cfc-8d48-c91729b75353","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.834921Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:f09bdbb19ec57969b0f45ccb4fe80c6dc72bdb2f89caf02d58036463b9e3f79a","observation_id":"96a9deb6-ff0a-4d6c-91b0-68f850c2e864","resolution":{"observed_at":"2026-08-08T14:47:47.198191Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.697394Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.697394Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5eecc19735378a7b9dc015f51c634a83448f787d14fd798e899ccfa01a872d0f","observation_id":"c907139a-29f1-49b1-b184-630a1581e8a4","resolution":{"observed_at":"2026-08-08T14:47:41.697394Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.184425Z","title":null,"venue":null,"work_id":"1dcafcb9-36f3-443b-bb3b-44607a7c9cfd","year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.838588Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:0d31ab0a73562d0fc544d0468cfe7e85fd668e61a5026c8e0f54846cedf675f9","observation_id":"69bb8ab5-42dc-4b7a-9ba6-030af1ae7b47","resolution":{"observed_at":"2026-08-08T14:47:47.187689Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.842093Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.842093Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:72a41f1ba954e9d8f6beeefb31e3bb5fc32fa05e1fb9f15deba125f1ae81d253","observation_id":"555e8f4a-a668-4504-b513-71db4ecc4775","resolution":{"observed_at":"2026-08-08T14:47:41.842093Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.850372Z","title":"International Journal of Safety and Security Engineering 11, 5 (2021), 537–545","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.850372Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5e7008bb18ce532d38352e354b118d9be051b47d0c9cb34afb1e8fa8a0e5befc","observation_id":"113264e6-ecb4-4094-8986-328e730f92ba","resolution":{"observed_at":"2026-08-08T14:47:41.850372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.174233Z","title":"In 32nd European Conference on Object-Oriented Programming, ECOOP 2018, July 16-21, 2018, Amsterdam, The Netherlands (LIPIcs, Vol","venue":null,"work_id":"6c72b29f-589b-429f-aa22-c33f180a9c88","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.853952Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a4c1b01dda7075ffbe5b0305aff299e45ed40e72050fcc5e785c5a58d572fa03","observation_id":"daf771f2-f24b-4c4a-b2aa-dcec87e0fc94","resolution":{"observed_at":"2026-08-08T14:47:47.178309Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.750096Z","title":"We Feel Like We’re Winging It:","venue":null,"work_id":"bd99c20a-ac15-42e7-9be9-2eb2007fba1b","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.861467Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8e1fde977f6ba1b350bddc4b809cfaf5d9ce67e33101a27cb79725ab6049e43c","observation_id":"61252c29-4b2f-46e8-b8bc-0aa2b99bb989","resolution":{"observed_at":"2026-08-08T14:47:45.753573Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.584594Z","title":"In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE 2017, Urbana, IL, USA, October 30 - November 03, 2017","venue":null,"work_id":"71565ae3-c71e-421e-90bc-3062d2b54548","year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.865314Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ffc4e14d63997c8700614b53d504189b277768c8af419596c86c4233c3d5ecbc","observation_id":"75f81c12-26fe-4307-909d-2b67786e6b70","resolution":{"observed_at":"2026-08-08T14:47:45.587920Z","resolver_source":"arxiv_id_nonexistent","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3460319","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.069216Z","title":"In ISSTA ’21: 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, Denmark, July 11-17, 2021 , Cristian Cadar and Xiangyu Zhang (Eds.)","venue":null,"work_id":"d655b275-6815-4f0e-8881-792504710341","year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.869552Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8e6d271150756b03fe06a2f098c89ceb9633cf44c8ec8438e6ae5181a77db58c","observation_id":"325435aa-1c4b-4b0c-ba1b-c2e3ef29f8ed","resolution":{"observed_at":"2026-08-08T14:47:42.073955Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.873156Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.873156Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:381619623cb8f583cab9bb461c364548f8bb3436c812dd2210adf05caa5a1627","observation_id":"669127a9-de72-4b2b-a311-987f038a8c48","resolution":{"observed_at":"2026-08-08T14:47:41.873156Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.163420Z","title":null,"venue":null,"work_id":"b7490233-be5c-4879-8e11-2317cf83a826","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.876547Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:6a413a04642a83caf84520ecbb061c093a30410d11999d16b27a70eb39471212","observation_id":"9898a980-c6e1-4934-8c21-eb4727e76cdc","resolution":{"observed_at":"2026-08-08T14:47:47.167322Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.418943Z","title":"In Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, ESEM 2018, Oulu, Finland, October 11-12, 2018","venue":null,"work_id":"78e18f58-4fa9-4fa5-b1ed-56cfce6858f6","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.880323Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4e3b7d918fd474298cc0179435a0f89e5596da5b30e67a54b95700c4f42cf3cb","observation_id":"923349d3-172d-4a1d-8d4a-b999efd98b25","resolution":{"observed_at":"2026-08-08T14:47:45.422060Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.152080Z","title":"In CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13,","venue":null,"work_id":"39f9de0f-a336-4c79-a435-bd0f36b261ae","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.884068Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:599658c221a8ddc00de017b2c1a25c3369a13f3723ccbeeaa353807f3d4c791c","observation_id":"8826fc05-7e7d-41aa-b5e4-046980d2f60b","resolution":{"observed_at":"2026-08-08T14:47:47.156245Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.219838Z","title":"https://doi.org/10.1145/3372297.3417232 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell","venue":null,"work_id":"372e7770-893a-401d-9bb9-61f443c7b1b5","year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.887786Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:f00e204f7e0ae5b4a3bc6cc66cbea65a51ab1a07918b7efc4f76c36e33f612ac","observation_id":"0d8f9953-892e-4bfa-8758-099729bfaa01","resolution":{"observed_at":"2026-08-08T14:47:45.222879Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.065631Z","title":"https://doi.org/10.1109/MSR59073.2023.00073 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell","venue":null,"work_id":"6ae21d63-5b2c-4bd7-802e-4ffb5d5fded9","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.891267Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ab2ea13b2603fecc67cf16ed47e557e77b3df890f32cc6363c7be8a77e181da2","observation_id":"14b8984a-7949-414c-981a-87ecede5d540","resolution":{"observed_at":"2026-08-08T14:47:45.069011Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.139543Z","title":"Retrieved December 11, 2023 from https://semver.org/ Maciej Radzikowski","venue":null,"work_id":"ffc4c640-8211-4857-9c9d-1957665e0618","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.894679Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:6a5a97290e759706f1baa8cb8a83387ebef973ac70e2bc12b74ef5c707632c19","observation_id":"de6731d7-3824-4875-bf93-bfe35d9aac93","resolution":{"observed_at":"2026-08-08T14:47:47.144434Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.128834Z","title":"Retrieved December 13, 2023 from https://betterdev.blog/pin- exact-dependency-versions/ Steven Raemaekers, Arie van Deursen, and Joost Visser","venue":null,"work_id":"da949ce5-db4c-4980-8f7a-541098ab2ae6","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.897906Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:87477ad653400a9955aef9bcf03929242778602f1b38442420c6348899007f4d","observation_id":"c5cecf67-c56e-4f01-9735-a0782dcf24f2","resolution":{"observed_at":"2026-08-08T14:47:47.132947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.901246Z","title":null,"venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.901246Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:69d7eb0b608964a79f2575f2e80d3a755acde70761ca62f780a8914a2e249b99","observation_id":"b94949b1-86c4-4e7f-ad3b-f5e4a874b206","resolution":{"observed_at":"2026-08-08T14:47:41.901246Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.116231Z","title":"Retrieved May 23, 2024 from https://developer","venue":null,"work_id":"79ae9cc8-b0ea-4e5e-aa35-963846fdd1b6","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.904631Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:0527c92ef7e44f9e5e623b9817728ec2833599e4e4de734738ec7a827cb3b021","observation_id":"a44aae65-f132-4eba-8017-5a36187904bd","resolution":{"observed_at":"2026-08-08T14:47:47.121257Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.103633Z","title":"com/dependency-pinning Edgar H Schein","venue":null,"work_id":"ee913079-17e1-412f-bce3-e268a7fdadde","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.908224Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:733afae15563fec08d34698d0877d75a0b8054e93ba6c99316522f0cd2299bfb","observation_id":"61fddeae-0179-4f1c-9adc-296108ac51ae","resolution":{"observed_at":"2026-08-08T14:47:47.107889Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.092101Z","title":"Collective Intelligence 3, 1 (2024), 26339137241231912","venue":null,"work_id":"0073568f-19ee-449a-aae8-49ee23950620","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.911525Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:539a5536f44bdb217e2cd65d1c88f166d610481e1dadb70b16dbed3406b85036","observation_id":"d20b2bee-4f50-4e44-a811-f8424d69064a","resolution":{"observed_at":"2026-08-08T14:47:47.096327Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.907778Z","title":"In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022, Pittsburgh, PA, USA, May 25-27, 2022","venue":null,"work_id":"fcfc0f80-28d5-43aa-abaf-e9ebaa632bd8","year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.914521Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:191682f06411534122d92fe9f90a9104f08de11b2bbeab29e5819cd0a82f5245","observation_id":"27561123-e884-4fea-be27-ae277cb98e5f","resolution":{"observed_at":"2026-08-08T14:47:45.912089Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.054698Z","title":"Retrieved Augest 22, 2023 from https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ Sonatype","venue":null,"work_id":"3b32b99f-4787-410a-a4cd-806dc23a8016","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.927695Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1a6435f8291cac42031e657b345d3590a7efbac7a9e29da87eac1ad3e4c7844e","observation_id":"d732046b-45e9-42cb-be0c-b72111ce1b6f","resolution":{"observed_at":"2026-08-08T14:47:47.060566Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.026643Z","title":"Retrieved May 24, 2024 from https://www.sonatype.com/ blog/software-supply-chain-a-definition-and-introductory-guide Sonatype","venue":null,"work_id":"0531853f-0e38-4cc6-8d0f-ae63c3fd7f09","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.930637Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:2ff81492b50fd0138e4205b0b1473b9d5a8c3644119420c40530593432b8ab36","observation_id":"5de800df-8ac0-472e-a123-f2d9800980d4","resolution":{"observed_at":"2026-08-08T14:47:47.032182Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"questions/2850948","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.539481Z","title":"com/questions/28509481/should-i-pin-my-python-dependencies-versions Alois Stutzer and Bruno S Frey","venue":null,"work_id":"e2ce3158-8603-4b32-886e-db8534adbd30","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.937646Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:9ac49f4a314418b3ed16100f2b7d2a4e1532502c9a3257e5dc3852ce90a5a9ad","observation_id":"7a4568b7-82fa-4c1f-a105-e1375cafeda0","resolution":{"observed_at":"2026-08-08T14:47:44.544941Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1016/j.socec.2005.11.043","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.043258Z","title":"https://doi.org/doi.org/10.1016/j.socec.2005.11.043 TechTarget","venue":null,"work_id":"236db5f7-e225-4fc6-8586-d9f6f27513b2","year":2006},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.940996Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c47ca0075c586fdb9470d457c1f4679ce24bcda19addad8a6201aabc36817127","observation_id":"0aefaed7-686c-449b-9b6f-8affe7bb9b1f","resolution":{"observed_at":"2026-08-08T14:47:42.048466Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.012897Z","title":"Retrieved May 22, 2024 from https://www","venue":null,"work_id":"17bfb2df-a453-4e55-ad5d-b7011e17f829","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.944230Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:0f03b0208fc46324bfef8af263afad647c10ade8bae665435af0cd760eae4829","observation_id":"a8ac293a-e596-46a3-b3fb-06101f627c64","resolution":{"observed_at":"2026-08-08T14:47:47.017759Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.999913Z","title":"Retrieved August 27, 2024 from https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the- nations-cybersecurity/ David A","venue":null,"work_id":"ca2910f4-367b-46e7-b84b-837dd706e76c","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.947138Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b085fe6494ad5d9160b9964f610b7faae13043651a22db7631ddb57f6940ca55","observation_id":"a6bcc374-f37c-467a-a6d3-56f72e5a4aa6","resolution":{"observed_at":"2026-08-08T14:47:47.004958Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.984738Z","title":"In Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May Proc","venue":null,"work_id":"4c6bcb9f-2300-4ad9-a7a2-4e2a480a8d8a","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.949971Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8580dbc1c26c3e4c47f554d016ae12092fdada9792a97e8d631b20f9dbe698dd","observation_id":"12026f34-d8d6-4466-bc96-8de8bfa49a1e","resolution":{"observed_at":"2026-08-08T14:47:46.990076Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.423371Z","title":"https://doi.org/10.1109/ICSE.2019.00048 Marat Valiev, Bogdan Vasilescu, and James D","venue":null,"work_id":"a5789cee-90d1-4296-8a85-e94678b3068e","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.952909Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1e3df532c5f372884de0a3c73d30fcee625c1bed50395466276e91a1e0614e05","observation_id":"7625dc85-0b40-4930-98b1-aadec5531b1a","resolution":{"observed_at":"2026-08-08T14:47:44.430073Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.075809Z","title":"In ESEC/FSE ’20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020","venue":null,"work_id":"493bb1f2-f441-43e8-bd48-17a781da2ef5","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.958678Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:65b4dcd5baf8c97ebe4d1dd36ee7aa660664853749f5f183244f645e3765f842","observation_id":"114013b8-e260-4fc8-b358-562f8b51c935","resolution":{"observed_at":"2026-08-08T14:47:44.084477Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.894628Z","title":"In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, Genoa, Italy, September 7-11, 2020","venue":null,"work_id":"9b65e3bf-58be-4200-84b6-29190873f230","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.961967Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4966e9f47d8c98b8c6eb31f9848f4dd6b60cf8ba04791abab21fb8aede934938","observation_id":"0b461f4e-83ef-47a7-967e-f84d35bbfd39","resolution":{"observed_at":"2026-08-08T14:47:43.898709Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.728940Z","title":"In MSR ’20: 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea, 29-30 June, 2020","venue":null,"work_id":"d1d562f2-9385-4597-be76-bc9cd4f02c9f","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.965332Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:320e83f235d0c2bf766ba7bbdc8c021a49d59b87b40bdddb14e8331daf572b3c","observation_id":"bf12e4f3-80f7-409d-afb9-a7405b56cd2d","resolution":{"observed_at":"2026-08-08T14:47:44.735239Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.650207Z","title":"IEEE Trans","venue":null,"work_id":"7f4ca44d-e8b6-43c3-84fc-5eca707021d3","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.968857Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5651a7e9de0def9a5c878949d73b78e981afd04c0a58c46683bc94e97b5cc032","observation_id":"e11501fe-1609-43ed-b9b8-c59a29e2d30a","resolution":{"observed_at":"2026-08-08T14:47:43.656697Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.474084Z","title":"In ICSE ’20: 42nd International Conference on Software Engineering, Seoul, South Korea, 27 June - 19 July, 2020","venue":null,"work_id":"838e373a-a864-43a8-baba-e806a3900710","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.972039Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1bc234572fbb0fc8d140509c477c174da931f6fe4fca4bdfab3b52e3783ab356","observation_id":"a2ff3e98-a8bd-42cb-81c0-7e5640567a1e","resolution":{"observed_at":"2026-08-08T14:47:43.478468Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.254565Z","title":null,"venue":null,"work_id":"12955be4-9fe8-41a9-9315-daf27d8e2448","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.975151Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:52113c606987f0daa58c27ec010267c6724abb5b124849543067ee9a42cd7aa2","observation_id":"b6217755-a72f-4165-93aa-b93b17558a9a","resolution":{"observed_at":"2026-08-08T14:47:44.257906Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.971313Z","title":"Retrieved May 23, 2024 from https://www.hyrumslaw.com/ Jiadong Xie, Fan Zhang, Kai Wang, Xuemin Lin, and Wenjie Zhang","venue":null,"work_id":"1a128940-127e-4027-8c35-2d5ab5b468a3","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.978367Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:e93db83249e11bbf6fa59328b960f6cbbe43072c0a9e2170449144da032483e8","observation_id":"0bbbf1d8-6a27-4014-b48b-1d1d7542547c","resolution":{"observed_at":"2026-08-08T14:47:46.975874Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.308835Z","title":"In 39th IEEE International Conference on Data Engineering, ICDE 2023, Anaheim, CA, USA, April 3-7, 2023","venue":null,"work_id":"f02dddf8-386e-4fd0-bf09-60fbf6bf9405","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.981775Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b3f8878034500cc1238e3c90db37c815cba86b016e4a597f947f5e2956b94691","observation_id":"d5427762-551f-425c-992d-b31e3c146387","resolution":{"observed_at":"2026-08-08T14:47:43.315430Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.141483Z","title":"In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023, Luxembourg, September 11-15, 2023","venue":null,"work_id":"7b7acf1b-c8e0-464f-b22b-15a9c0e597eb","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.985430Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:20f70cbc5db941e5e829a985298a285c00001bcfb29634f388ee44586c569298","observation_id":"df452be6-2c84-4205-9291-1dc05896eed5","resolution":{"observed_at":"2026-08-08T14:47:43.157126Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.931073Z","title":"In Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy, CODASPY 2016, New Orleans, LA, USA, March 9-11, 2016","venue":null,"work_id":"0db050e8-b447-4292-bfc3-105308ea7ff1","year":2016},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.988982Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8df189df6e4fa91b18b00b7985ab4562bc1ede6fd55f218815abf07ff73cf327","observation_id":"b9117aa3-3e2a-4f98-a114-0cf8430d0427","resolution":{"observed_at":"2026-08-08T14:47:42.941204Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12196","last_updated":"2025-01-06T16:29:32Z","snapshot_observed_at":"2026-07-06T17:46:38.027974Z","submitted_at":"2024-03-18T19:10:12Z","title":"Leveraging Large Language Models to Detect npm Malicious Packages","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12196","snapshot_observed_at":"2026-08-08T14:47:41.992065Z","title":"CoRR abs/2403.12196 (2024)","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.992065Z"},"links":{"cited_paper":"/paper/2403.12196","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c2f20e25f4ed6b76120f1cf23104744257a8600360066f8c23eaa94cb8ac2466","observation_id":"056bbb45-f0e1-450c-9399-e4b0d788acf1","resolution":{"observed_at":"2026-08-08T14:47:41.992065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.650055Z","title":"https://doi.org/10.1109/ICSE-SEIP58684.2023.00032 Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Bihuan Chen, and Yang Liu","venue":null,"work_id":"25856208-a753-4c75-8ccd-190f14c6282a","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.995901Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1e0b4c0f181e1cc771e7f4e87303aca2a1f58ecb929c6a841752de60fe7c7c3a","observation_id":"05e9111e-1a26-4492-97f5-b78a56c245c6","resolution":{"observed_at":"2026-08-08T14:47:42.697912Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.453521Z","title":"In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022","venue":null,"work_id":"4cac177e-f34c-4b51-a6ed-df1bf0399c6a","year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.999041Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:53b4475f5970bcfb647f1f468d26d43ab48b05f4d9bb9950a7b0e8a7ebfa41bf","observation_id":"b814acef-2772-4a1c-a439-1eb01d565b3d","resolution":{"observed_at":"2026-08-08T14:47:42.478014Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.958274Z","title":"In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019","venue":null,"work_id":"29b5e80c-027a-4920-a372-f7bdf99d1eca","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:42.002141Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:37b370bf46f624931251bc3fc4e789fc385f0f1f9390019ec863eec7e24ed0fd","observation_id":"c08318a9-3ab5-4d4c-9ec0-b98ddc92ec42","resolution":{"observed_at":"2026-08-08T14:47:46.963815Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.4230/lipics.ecoop.2018.7","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.081180Z","title":"https: //doi.org/10.4230/LIPICS.ECOOP.2018.7 Courtney Miller, Christian Kästner, and Bogdan Vasilescu","venue":null,"work_id":"e2dd6fd1-b33d-4e83-a43e-0dbd9fb0dc6e","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":109,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.857721Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:cd6f2a0b42ab80f57fda800052804720966667493227698c3e553499e924b707","observation_id":"558903fa-0957-42cf-ac35-873077824b37","resolution":{"observed_at":"2026-08-08T14:47:42.085638Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1037/a0017543","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.141548Z","title":null,"venue":null,"work_id":"6914053d-60cd-478c-ae59-b3258ccfc23e","year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":477,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.758764Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1f583a122ed65039c7965651187ac2373c6634ad4ed56f13bfbb2853826e4bf2","observation_id":"252a3ad4-1c5c-4f3c-8cdb-a8e58ec46650","resolution":{"observed_at":"2026-08-08T14:47:42.172227Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.067776Z","title":"Science 236, 4799 (1987), 280–285","venue":null,"work_id":"4638db50-c2f9-4847-8dc1-8d8f8816210f","year":1987},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":1987,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.924413Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a171881fb14ea5d270738911b0483f6d65b89b610b53112ea9b004d3579a4d91","observation_id":"586df582-df71-4d6b-91ed-2fb959958ab8","resolution":{"observed_at":"2026-08-08T14:47:47.072012Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.713137Z","title":"Archives of Internal Medicine 159, 17 (1999), 2070–2076","venue":null,"work_id":null,"year":1999},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":1999,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.713137Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:67acab657e2713ef2402c2397e5b8b6b84217ace215cf831e07afa4c5fce4d61","observation_id":"bbe84ed5-f4c3-42a5-9a0d-de0b5a215c32","resolution":{"observed_at":"2026-08-08T14:47:41.713137Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.846000Z","title":"In 21st IEEE/ACM International Conference on Automated Software Engineering (ASE 2006), 18-22 September 2006, Tokyo, Japan","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2006,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.846000Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:03a130fa1ad4bbdbf6f90264180b83bd0e9a5855f74c40b0eb1fcb5441e28a49","observation_id":"63c8971e-d38b-402e-b86f-d26698db6e37","resolution":{"observed_at":"2026-08-08T14:47:41.846000Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.293872Z","title":"Psychology and Aging 25, 2 (2010),","venue":null,"work_id":"77b9bae5-7933-47fe-919d-9cc682e8cebe","year":2010},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2010,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.754913Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:f29fe6ff7b1e3a8987723bae3783469ec2b23790057b096c41a7a11d45496923","observation_id":"cda830f3-f9b2-49a0-82fa-6febecbc2b77","resolution":{"observed_at":"2026-08-08T14:47:47.298202Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.079970Z","title":"Frontiers in Psychology 3 (2012),","venue":null,"work_id":"20a37c31-9531-47c6-a990-8ed2e09f570c","year":2012},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2012,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.917788Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:e5274689997916d114527d50f143531d0cb6f61764f071dfa6ac5c511fcc14bb","observation_id":"7dae9ad3-694c-407f-bf9b-5cc036491e74","resolution":{"observed_at":"2026-08-08T14:47:47.084212Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.889467Z","title":"In 36th International Conference on Software Engineering, ICSE ’14, Hyderabad, India - May 31 - June 07, 2014","venue":null,"work_id":"6b1ebf7b-e4d6-4449-b6e5-b58bb6346726","year":2014},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2014,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.921185Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:2d0c0cd13befb390ae6d2cb351c74d2a27017c5fa5b6abcfe608001a867bb577","observation_id":"de336b92-c7d1-476c-8e19-4ef4f2c0c64a","resolution":{"observed_at":"2026-08-08T14:47:44.892694Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.685197Z","title":"The Sage Handbook of Regression Analysis and Causal Inference 327 (2015),","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2015,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.685197Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:73cb23675bf07b71faa98cfb571d3cab89da8ea3cf430406e461c174e08102db","observation_id":"c34ad358-91e1-4bd9-a589-512c8547face","resolution":{"observed_at":"2026-08-08T14:47:41.685197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.740220Z","title":"The Unseen Labor Behind our Digital Infrastructure (2016)","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2016,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.740220Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d1e668e447e1445d32460666a4404c07e00148459f22219695d2332df606684a","observation_id":"e42569f0-f8db-46fb-8da1-c74d39b2ddf2","resolution":{"observed_at":"2026-08-08T14:47:41.740220Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.661302Z","title":"In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, Paderborn, Germany, September 4-8, 2017","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2017,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.661302Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bc9ea4160b1016e44ea883a496227c4d7fa21c9a6585ccbe5707ea199f478439","observation_id":"e7f58e59-cc9c-4948-8db3-2e69aa13db85","resolution":{"observed_at":"2026-08-08T14:47:41.661302Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.729021Z","title":"In Proceedings of the 15th International Conference on Mining Software Repositories, MSR 2018, Gothenburg, Sweden, May 28-29, 2018","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2018,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.729021Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5cbc242bd76b3e1160e7417d9a5a34b2988b2ee49107cf33b8decd71fc289bd1","observation_id":"5d6d20eb-f887-4f55-8b34-b721f2052300","resolution":{"observed_at":"2026-08-08T14:47:41.729021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.732395Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2019,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.732395Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:88ce90bac4c332a42f3087d31f565525707d31617005621a6b1aa748530b09d5","observation_id":"303557ed-a2e3-4dec-b975-a8b1323319c1","resolution":{"observed_at":"2026-08-08T14:47:41.732395Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.656241Z","title":"In 27th IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2020, London, ON, Canada, February 18-21, 2020","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2020,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.656241Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3d902d7eacdadddaa6d60e109b50a612df26b1d05233a057e05d42990fd3a109","observation_id":"6143d244-fde8-4851-a8de-f1eb1744d77d","resolution":{"observed_at":"2026-08-08T14:47:41.656241Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.667102Z","title":"In 18th IEEE/ACM International Conference on Mining Software Repositories, MSR 2021, Madrid, Spain, May 17-19,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2021,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.667102Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b94237223ed2b582590b3ff91d6a74edb932084fe5e96975d55911065bea9b33","observation_id":"ea7ebf12-fe2b-4eb4-be2b-5db539f10c4f","resolution":{"observed_at":"2026-08-08T14:47:41.667102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.680448Z","title":"Feelings","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.680448Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3c1e6c9fd86e124ae934d50e3f3f4835419a04ba04c847c16f9ee8f01a4dff79","observation_id":"9af679c5-9316-4702-8a64-3b5ad268296b","resolution":{"observed_at":"2026-08-08T14:47:41.680448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.689531Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.689531Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5c8d538ad9d736299d4ab89ca7a604cb9a321974813b6a92bfeea8a47b34b02b","observation_id":"fafbb455-9c60-4d5a-8bb5-a6ec13b7bf51","resolution":{"observed_at":"2026-08-08T14:47:41.689531Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.709273Z","title":"Retrieved April 28, 2024 from https://cran.r- project.org/web/packages/plm John R Crouse, Timothy Morgan, James G Terry, Julie Ellis, Mara Vitolins, and Gregory L Burke","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.709273Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:29beb6968b027066264d6ab44719baf6a969f0325319f0080a58c8ebf1b1da78","observation_id":"38a58db0-2da1-4156-bd8e-17f2044f81f5","resolution":{"observed_at":"2026-08-08T14:47:41.709273Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks"},"reference_resolution":{"displayed":92,"state_counts":{"malformed_identifier":1,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":40,"verified_exact":23,"verified_fuzzy":26},"total_outbound_references":92},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 92 of 92 outbound references and 2 inbound Pith citation observations for arXiv:2502.06662."}