{"as_of":"2026-08-23T12:41:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2d72e2e2de9c7ee1d47f7498d76e89d0702e9fe276b1e809d21e7594a7a7c20d","coverage":[{"denominator":29,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":29,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-08T21:35:45.183626Z","state":"measured"},{"denominator":29,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":29,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-23T06:30:58.430688+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.05894/citation-record","integrity":"/paper/2607.05894/integrity","json":"/paper/2607.05894/citation-record.json","paper":"/paper/2607.05894"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.959364Z","title":"Backstabber’s knife collection: A review of open source software supply chain attacks,","venue":null,"work_id":"c155e139-83e3-475b-89cc-a37e0744b7ee","year":2020},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:0bfd7e1949bab28bba8b12c50b51842b1b8367fb231c65cad84dc09660a264db","observation_id":"65115e45-6d8e-4153-acf8-8aa6434227d1","resolution":{"observed_at":"2026-07-08T21:45:39.960498Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.966080Z","title":"Sok: Taxonomy of attacks on open-source software supply chains,","venue":null,"work_id":"95130e9c-de1d-45d1-91c7-038568f9a855","year":2023},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:1dbc4f2ed444844a48085064853a5300b89837b9dca575222cfbc6696aa2a920","observation_id":"c346c68f-1888-49cd-95ab-f72b091aef05","resolution":{"observed_at":"2026-07-08T21:45:39.967231Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.987770Z","title":"Perspectives on the SolarWinds incident,","venue":null,"work_id":"2bee92a4-3889-4ca0-95d5-4768f7a22752","year":2021},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:ad50cd1612e47c1a8a1a97641c16f5ce3011285f259d80c21705510fcf22f344","observation_id":"037b0b8c-0b96-4e3a-b720-5bbc5f134820","resolution":{"observed_at":"2026-07-08T21:45:39.988823Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.961018Z","title":"CVE-2021-44228: Apache Log4j2 JNDI features remote code execution,","venue":null,"work_id":"fdf09cc0-a552-4768-b9da-9b069dfe0a3f","year":2021},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:56fefa992854848a9d0870239c6cfa9a5d1e2bdc5fcf81e876e913cf786128c4","observation_id":"4d8745c5-2feb-408e-9e07-a7b253453c8a","resolution":{"observed_at":"2026-07-08T21:45:39.962132Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.956012Z","title":"Detecting suspicious package updates,","venue":null,"work_id":"9c3a0807-e4f3-46f0-8f82-b61ce8ec2269","year":2019},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:9a3c9b90251c9d05f8661fd5f79bcba3632a1171c0fbb9e22adf835978acdfb4","observation_id":"a8bc5c11-9f86-495b-ac29-d92f23b259c6","resolution":{"observed_at":"2026-07-08T21:45:39.957131Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.957665Z","title":"Executive Order 14028: Improving the Nation’s Cybersecurity,","venue":null,"work_id":"6fbc061c-9997-4de6-9b4a-6fc7cc0286c0","year":2021},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:6f63ec327ff98e9fdb62c225a97881b28183e4f068eefa86ed2cb56dff4f711c","observation_id":"fadc0276-0c35-429d-9616-ff770e165d89","resolution":{"observed_at":"2026-07-08T21:45:39.958826Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.964378Z","title":"An empirical comparison of dependency network evolution in seven software packaging ecosystems","venue":null,"work_id":"5ab8fbe4-e254-4fd4-b962-dec35b91dfdb","year":2019},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:ce929f750f88dea6d03891fedb4d9b64732335e04e771e8162d1992706495612","observation_id":"6d160f15-eb29-4757-a926-1a8b821dfa74","resolution":{"observed_at":"2026-07-08T21:45:39.965538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.980693Z","title":"Snyk: Developer security platform,","venue":null,"work_id":"f1a6913c-6519-4ae3-9339-dff52f5dd810","year":2024},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:392491396f93b94554bad4af6b1c7919558f301b7420f5ff630e689f8d9ccfde","observation_id":"1e63a8e7-56a8-4061-8203-f962ec13948f","resolution":{"observed_at":"2026-07-08T21:45:39.982126Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.997762Z","title":"Dependabot: Automated dependency updates,","venue":null,"work_id":"32ea2733-30c0-4c78-beaa-6d8c48893ad8","year":2024},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:2a64b166747890b0760783a1d2863a4dfe00c6f319061fbc306afe06383059cf","observation_id":"97e02629-52a8-40dd-965d-ed0195bfcdc0","resolution":{"observed_at":"2026-07-08T21:45:39.999028Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.991053Z","title":"Understanding software vulnerabilities in the maven ecosystem: Patterns, timelines, and risks,","venue":null,"work_id":"11652cc8-bedd-48cf-a298-557f0112290f","year":2025},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:f65eb3970038fe4b153c09a799e617b072ec35fb7dc3f6e1e408d90546abb409","observation_id":"f0958517-1de6-47dd-8e74-7aca7e8e37fa","resolution":{"observed_at":"2026-07-08T21:45:39.992195Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.996052Z","title":"On the impact of using trivial packages: An empirical case study on npm and pypi,","venue":null,"work_id":"3d52ed9c-3f37-4f64-8185-b1a120ee0f93","year":2020},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:3e8050a93d80538bf5f611ba37ceafff222a8af3f98964cf20dfd42d25ba792c","observation_id":"71be6df3-097c-453f-965e-91620f4b2d38","resolution":{"observed_at":"2026-07-08T21:45:39.997229Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.975866Z","title":"Reachcheck: Compositional library-aware call graph reachability analysis in the ides,","venue":null,"work_id":"2b32ebe6-b00a-44e8-b2e3-d90bf9131638","year":2026},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:c569f4be060f05c9d0151e9926ee948ed053775133ef3499c7bd3883224ea5ae","observation_id":"5b8a4680-ec2d-4ea9-a08b-2a6ef5390a37","resolution":{"observed_at":"2026-07-08T21:45:39.977003Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.967751Z","title":"Do developers update their library dependencies? an empirical study on the impact of security advisories on library migration,","venue":null,"work_id":"5eec1d79-ab06-486b-9285-fa43bc844260","year":2018},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:684e95ac6029c06f2b04b41c3c41b96de24ae7026d16955f1aee2663707787b8","observation_id":"e3c39775-7ac5-4d0a-ad9d-aeb923d86c18","resolution":{"observed_at":"2026-07-08T21:45:39.968930Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.962647Z","title":"On the effectiveness of machine learning-based call graph pruning: An empirical study,","venue":null,"work_id":"5d6e9afe-cdef-43bf-a221-15598f6f1a87","year":2024},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:e7b02318fc7da5702d3a90f45cc0b5889f9db0346b412124d234cadd5ce7fc9f","observation_id":"01471f6a-b773-400f-a012-2ab397eecde3","resolution":{"observed_at":"2026-07-08T21:45:39.963823Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.969446Z","title":"Insight: Exploring cross-ecosystem vulnerability impacts,","venue":null,"work_id":"63908223-58e5-4270-9389-73c76dc80410","year":2022},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:8c4edc06e9afbf718959323b50bdc067986e2f95f9745e8129dd9a3b9a223642","observation_id":"c8d784e8-66ab-4c22-8fef-0810e9dd4344","resolution":{"observed_at":"2026-07-08T21:45:39.970560Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:40.001195Z","title":"Small world with high risks: A study of security threats in the npm ecosystem","venue":null,"work_id":"0017183a-fdec-444a-8485-39dba666d53e","year":2019},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:9003caa9215736caf65ea8a047f9137b7fcc6faf2c78390e32d60c0308cbf8f5","observation_id":"c2bfb2ba-2889-403d-92f0-0601dfd48bea","resolution":{"observed_at":"2026-07-08T21:45:40.002366Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.992732Z","title":"GHSA-3fx5-fwvr-xrjg: Regular expression denial of service in ms,","venue":null,"work_id":"283866c2-75ec-424d-9c61-56624e713fa2","year":2016},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:7faa8f7a6a1e14f08f628840ff83c9cb1317b51f0ebfc67523ff06b437ded201","observation_id":"79992d68-c27d-4f6e-be80-a7aaa877dc42","resolution":{"observed_at":"2026-07-08T21:45:39.993873Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.999588Z","title":"deps.dev: Open source insights,","venue":null,"work_id":"a3c043a2-39c5-4636-a23d-03d54e66ebdc","year":2023},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:7f2c2890e1fe08b0a8a8d0c49b00eeeff304436ac615d66f834a2a6e746ab899","observation_id":"bb43018b-43b9-4da0-abdf-871979aeca81","resolution":{"observed_at":"2026-07-08T21:45:40.000675Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.971094Z","title":"OpenSSF Scorecard,","venue":null,"work_id":"36c8b918-aa3d-4e6b-8d78-d27b35407981","year":2023},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:fa13ec01eae0c256c9da0b8abbf8a7c8d9485471550787a53d94749436b42dbc","observation_id":"14484f59-95d3-4a57-928a-d05ef6c15622","resolution":{"observed_at":"2026-07-08T21:45:39.972085Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.994393Z","title":"Measuring dependency freshness in software systems,","venue":null,"work_id":"a0e23d34-cd9c-4607-bed3-5fa862317273","year":2015},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:7a62b4d239068d3527113749b629680678404940965939bcd2bfeb0cac4917e1","observation_id":"b5688b7a-4277-4a76-9657-d0a3de172eb8","resolution":{"observed_at":"2026-07-08T21:45:39.995491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.984260Z","title":"OSV: Open Source Vulnerabilities,","venue":null,"work_id":"10834d82-56c9-4ad4-a01f-4f13fea8a5d7","year":2023},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:9ea96a99b4a314197875e4d69283e4616b55ec946c7cf9979f9e9716e56409bf","observation_id":"1fc237ab-a138-4e8b-a2f4-1ac6c72f46a1","resolution":{"observed_at":"2026-07-08T21:45:39.985373Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.974247Z","title":"Vuln4real: A methodology for counting actually vulnerable dependen- cies,","venue":null,"work_id":"1b857f56-e10b-4df1-9072-a64411181947","year":2020},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:55dfe5e3d6de707035d53c410fafc4a62a2040010d0a91ad3c718a616979839b","observation_id":"2a21ca57-5e93-4b67-9868-8d45506a2d18","resolution":{"observed_at":"2026-07-08T21:45:39.975345Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.977524Z","title":"Renovate: Automated dependency updates,","venue":null,"work_id":"17d8b490-11fb-4d01-8946-3c30debdf53b","year":2024},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:c1489ec9213577757969a1fb8c38a50ffa09d9d03b918b9d2b5cb5c48515fd83","observation_id":"8bc67d09-49f2-4518-bbbd-834a227327bf","resolution":{"observed_at":"2026-07-08T21:45:39.978595Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.979076Z","title":"Impact assessment for vulnera- bilities in open-source software libraries,","venue":null,"work_id":"cb49ecd9-1851-4896-aec6-f11f50904912","year":2015},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:c947e254ff8a7cf309a22bd5064dd4f594d8cab07b0a045eadee9e9f5d082fe2","observation_id":"e9df4795-3221-4e66-be5f-e7cbff70d916","resolution":{"observed_at":"2026-07-08T21:45:39.980160Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.982665Z","title":"Pycg: Practical call graph generation in python,","venue":null,"work_id":"efaab57d-4084-4caf-817c-b6e3657bbefb","year":2021},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:9d569f45784556f0ebaba950a93b09cc9e9a65accce8af4c2840b66ff55e2392","observation_id":"b4b4a0c2-6201-4e97-abf9-e44e46c518c6","resolution":{"observed_at":"2026-07-08T21:45:39.983748Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.972599Z","title":"Beyond metadata: Code-centric and usage-based analysis of known vulnerabilities in open-source soft- ware,","venue":null,"work_id":"3883b7e0-f32a-40ed-8d4d-b0b79f99b300","year":2018},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:538f86fea8d2490682e522da7d9146bd98829984c5bb1d880e66013946dd1597","observation_id":"4b42bf5a-d0cb-4955-9d18-75ca74142d45","resolution":{"observed_at":"2026-07-08T21:45:39.973736Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:40.002908Z","title":"A manually-curated dataset of fixes to vulnerabilities of open-source software,","venue":null,"work_id":"8a2eb765-d39b-494a-a838-54b992a089d5","year":2019},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:e30f871dcb1912f6d96387efcb5d6a175543fd474e2010ccf53fb7e267df43ff","observation_id":"a0344fe5-b7e0-4f93-b5f8-41d373f556e4","resolution":{"observed_at":"2026-07-08T21:45:40.004051Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.985929Z","title":"Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem,","venue":null,"work_id":"81fbb3aa-183a-4927-be05-02e2156e16b8","year":2022},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:8abd557205f166dc0b26ac48ac0090b9085a91e9c66b7509cba5d27dd23304dd","observation_id":"c1137c9d-5d08-49ed-8409-996ea6a42a1e","resolution":{"observed_at":"2026-07-08T21:45:39.987234Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:45:39.989320Z","title":"Identifying challenges for oss vulnerability scanners-a study & test suite,","venue":null,"work_id":"5586db5c-398f-4478-baad-827dbf7f6772","year":2022},"citing_paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-08T21:35:45.183626Z"},"links":{"citing_paper":"/paper/2607.05894"},"observation_digest":"sha256:b396062403f6d73208ccc3c41a19073312a707ac8c0e0fd96167a71da24a4784","observation_id":"830dbeeb-2fa1-4a82-b756-cd5896f68201","resolution":{"observed_at":"2026-07-08T21:45:39.990509Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2607.05894","last_updated":"2026-07-07T06:45:25Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-19T03:25:12.321177Z","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains"},"reference_resolution":{"displayed":29,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":29},"total_outbound_references":29},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"thesis":"As of 23 August 2026, this Paper Citation Record lists 29 of 29 outbound references and 0 inbound Pith citation observations for arXiv:2607.05894."}