{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:5GTRY5PJU27U76XALHCSHXSY42","short_pith_number":"pith:5GTRY5PJ","canonical_record":{"source":{"id":"2607.05894","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-07T06:45:25Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"4b8d6556f19bfb656d6bc694855ec62bc0e42eb55f8d21c3a4bff0e472f38d4f","abstract_canon_sha256":"cff1b5e1390090d6cd428c0b81e9ae420ddb9c120099ba27dba9255a76af1110"},"schema_version":"1.0"},"canonical_sha256":"e9a71c75e9a6bf4ffae059c523de58e688f8f730eadddb83d001bd4e87db4b28","source":{"kind":"arxiv","id":"2607.05894","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05894","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05894v1","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05894","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_12","alias_value":"5GTRY5PJU27U","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_16","alias_value":"5GTRY5PJU27U76XA","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_8","alias_value":"5GTRY5PJ","created_at":"2026-07-08T01:18:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:5GTRY5PJU27U76XALHCSHXSY42","target":"record","payload":{"canonical_record":{"source":{"id":"2607.05894","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-07T06:45:25Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"4b8d6556f19bfb656d6bc694855ec62bc0e42eb55f8d21c3a4bff0e472f38d4f","abstract_canon_sha256":"cff1b5e1390090d6cd428c0b81e9ae420ddb9c120099ba27dba9255a76af1110"},"schema_version":"1.0"},"canonical_sha256":"e9a71c75e9a6bf4ffae059c523de58e688f8f730eadddb83d001bd4e87db4b28","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-08T01:18:49.533327Z","signature_b64":"+l5F7rGuFoWm4Ox3K1pksMyS61/PGE3LGdZRmyT/+pF0VOY42zW+OOSoxw+g4IwfxGq7a2TqD1YFdCOLX4jdDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e9a71c75e9a6bf4ffae059c523de58e688f8f730eadddb83d001bd4e87db4b28","last_reissued_at":"2026-07-08T01:18:49.532845Z","signature_status":"signed_v1","first_computed_at":"2026-07-08T01:18:49.532845Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.05894","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:18:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1mp4p8hRiIETONoVqBOgJs9IwYSyy1bngBJ6L2ArxQBUQJSenN/XHLWnUJ8Z4UCFGYZ4fwacSom76BdP4pP2CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-20T16:12:07.659209Z"},"content_sha256":"86c7dfb2fb0e721ef041a2984c99c837fd6bae8dde63facb304d5be34704fcb0","schema_version":"1.0","event_id":"sha256:86c7dfb2fb0e721ef041a2984c99c837fd6bae8dde63facb304d5be34704fcb0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:5GTRY5PJU27U76XALHCSHXSY42","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Indrajit Ray, Rafael Fabian Gonzalez Arellano, Rakesh Podder","submitted_at":"2026-07-07T06:45:25Z","abstract_excerpt":"Modern software supply chains comprise hundreds of transitive dependencies, yet existing analysis tools operate at either the ecosystem level (dependency graphs) or the code level (static analysis within packages). This separation creates two failure modes. First, false-positive CVE alerts for unreachable code. Second, blind spots for structurally critical micro-dependencies. We introduce cross-level risk propagation, a framework that bridges code-level risk metrics with ecosystem-level dependency exposure through a unified risk formula. Preliminary evaluation on 50 packages across npm and PyP"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05894","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.05894/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:18:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"x2hmywaSpDJ28lr6fpF1r+8U3Xy3IguP2UYP9dcFZxZh7h/383J6//unzyEmXK/XGJKnlquRlPkb8YuIkcBfAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-20T16:12:07.659593Z"},"content_sha256":"db4b8f9c216dd8d975497a6a9c3bc8b5117472a8a4e589c26089507c98da5d99","schema_version":"1.0","event_id":"sha256:db4b8f9c216dd8d975497a6a9c3bc8b5117472a8a4e589c26089507c98da5d99"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/5GTRY5PJU27U76XALHCSHXSY42/bundle.json","state_url":"https://pith.science/pith/5GTRY5PJU27U76XALHCSHXSY42/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/5GTRY5PJU27U76XALHCSHXSY42/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-20T16:12:07Z","links":{"resolver":"https://pith.science/pith/5GTRY5PJU27U76XALHCSHXSY42","bundle":"https://pith.science/pith/5GTRY5PJU27U76XALHCSHXSY42/bundle.json","state":"https://pith.science/pith/5GTRY5PJU27U76XALHCSHXSY42/state.json","well_known_bundle":"https://pith.science/.well-known/pith/5GTRY5PJU27U76XALHCSHXSY42/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:5GTRY5PJU27U76XALHCSHXSY42","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cff1b5e1390090d6cd428c0b81e9ae420ddb9c120099ba27dba9255a76af1110","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-07T06:45:25Z","title_canon_sha256":"4b8d6556f19bfb656d6bc694855ec62bc0e42eb55f8d21c3a4bff0e472f38d4f"},"schema_version":"1.0","source":{"id":"2607.05894","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05894","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05894v1","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05894","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_12","alias_value":"5GTRY5PJU27U","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_16","alias_value":"5GTRY5PJU27U76XA","created_at":"2026-07-08T01:18:49Z"},{"alias_kind":"pith_short_8","alias_value":"5GTRY5PJ","created_at":"2026-07-08T01:18:49Z"}],"graph_snapshots":[{"event_id":"sha256:db4b8f9c216dd8d975497a6a9c3bc8b5117472a8a4e589c26089507c98da5d99","target":"graph","created_at":"2026-07-08T01:18:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.05894/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Modern software supply chains comprise hundreds of transitive dependencies, yet existing analysis tools operate at either the ecosystem level (dependency graphs) or the code level (static analysis within packages). This separation creates two failure modes. First, false-positive CVE alerts for unreachable code. Second, blind spots for structurally critical micro-dependencies. We introduce cross-level risk propagation, a framework that bridges code-level risk metrics with ecosystem-level dependency exposure through a unified risk formula. Preliminary evaluation on 50 packages across npm and PyP","authors_text":"Indrajit Ray, Rafael Fabian Gonzalez Arellano, Rakesh Podder","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-07T06:45:25Z","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05894","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:86c7dfb2fb0e721ef041a2984c99c837fd6bae8dde63facb304d5be34704fcb0","target":"record","created_at":"2026-07-08T01:18:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cff1b5e1390090d6cd428c0b81e9ae420ddb9c120099ba27dba9255a76af1110","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-07-07T06:45:25Z","title_canon_sha256":"4b8d6556f19bfb656d6bc694855ec62bc0e42eb55f8d21c3a4bff0e472f38d4f"},"schema_version":"1.0","source":{"id":"2607.05894","kind":"arxiv","version":1}},"canonical_sha256":"e9a71c75e9a6bf4ffae059c523de58e688f8f730eadddb83d001bd4e87db4b28","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e9a71c75e9a6bf4ffae059c523de58e688f8f730eadddb83d001bd4e87db4b28","first_computed_at":"2026-07-08T01:18:49.532845Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-08T01:18:49.532845Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+l5F7rGuFoWm4Ox3K1pksMyS61/PGE3LGdZRmyT/+pF0VOY42zW+OOSoxw+g4IwfxGq7a2TqD1YFdCOLX4jdDA==","signature_status":"signed_v1","signed_at":"2026-07-08T01:18:49.533327Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.05894","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:86c7dfb2fb0e721ef041a2984c99c837fd6bae8dde63facb304d5be34704fcb0","sha256:db4b8f9c216dd8d975497a6a9c3bc8b5117472a8a4e589c26089507c98da5d99"],"state_sha256":"f446286c265c192a8df3b7a8c3cf0643400e8e15305ae96a4d2e2c5560a75ec6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uu9GtNHH2fnlRJbwoFPPb+BREHjac+cPz10P5zS9T0x9/VmWto2hDNXYRtGeDMdsDqWnyfMo/W2JiguYel1HDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-20T16:12:07.662004Z","bundle_sha256":"38b54c0edb15a0d76ca4e941980605ad18e400c72b1d99e65051f64ea135c600"}}