{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:5KPGZMSGLAKP2S3GKBT6LT2CUP","short_pith_number":"pith:5KPGZMSG","canonical_record":{"source":{"id":"2506.12995","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-15T23:22:25Z","cross_cats_sorted":[],"title_canon_sha256":"b304d892c3100a31658bf87507a869847f784c815dea6155d3720a655129ff46","abstract_canon_sha256":"6a115075347790140c75c3b5602d723e82fea9c54007bbdf60aa7eb58e9ad242"},"schema_version":"1.0"},"canonical_sha256":"ea9e6cb2465814fd4b665067e5cf42a3e8715b65453d9f999674db5d60e139c3","source":{"kind":"arxiv","id":"2506.12995","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.12995","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"arxiv_version","alias_value":"2506.12995v1","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.12995","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_12","alias_value":"5KPGZMSGLAKP","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_16","alias_value":"5KPGZMSGLAKP2S3G","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_8","alias_value":"5KPGZMSG","created_at":"2026-07-05T11:22:03Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:5KPGZMSGLAKP2S3GKBT6LT2CUP","target":"record","payload":{"canonical_record":{"source":{"id":"2506.12995","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-15T23:22:25Z","cross_cats_sorted":[],"title_canon_sha256":"b304d892c3100a31658bf87507a869847f784c815dea6155d3720a655129ff46","abstract_canon_sha256":"6a115075347790140c75c3b5602d723e82fea9c54007bbdf60aa7eb58e9ad242"},"schema_version":"1.0"},"canonical_sha256":"ea9e6cb2465814fd4b665067e5cf42a3e8715b65453d9f999674db5d60e139c3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:22:03.610811Z","signature_b64":"0Es3niQ2+js+5Hk93nS1nW+E/nYsdUFjf3Wl+ge9DuaV+FPhvaQzY6mcMTXpwBiuaws1K3uvRRu4YD8ECBQrCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ea9e6cb2465814fd4b665067e5cf42a3e8715b65453d9f999674db5d60e139c3","last_reissued_at":"2026-07-05T11:22:03.610292Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:22:03.610292Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.12995","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:22:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yOhi8I2GR2zc3lQLFzBevBirdL6G98H0xEeTX3CrLg8mgU2dSTtZHoHbBjXW/2Dg2ty16AKvJbF1YO4a1eZZDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:44:19.006985Z"},"content_sha256":"923d279c43ce0cb803179ba5f52ac70e19d90633c5ccd6806eee49ca7ab65983","schema_version":"1.0","event_id":"sha256:923d279c43ce0cb803179ba5f52ac70e19d90633c5ccd6806eee49ca7ab65983"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:5KPGZMSGLAKP2S3GKBT6LT2CUP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Open Source, Open Threats? Investigating Security Challenges in Open-Source Software","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Amin Kharraz, Behzad Ousat, Seyed Ali Akhavani","submitted_at":"2025-06-15T23:22:25Z","abstract_excerpt":"Open-source software (OSS) has become increasingly more popular across different domains. However, this rapid development and widespread adoption come with a security cost. The growing complexity and openness of OSS ecosystems have led to increased exposure to vulnerabilities and attack surfaces. This paper investigates the trends and patterns of reported vulnerabilities within OSS platforms, focusing on the implications of these findings for security practices. To understand the dynamics of OSS vulnerabilities, we analyze a comprehensive dataset comprising 31,267 unique vulnerability reports "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.12995","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.12995/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:22:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5BASHmFi+cLh/36uBd2fwef2734fOXcvuqWcm8/iGxJEmjv8pnlpyVtRmrBsEUqeS+jpcN9V9760hFlLKc90Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:44:19.007629Z"},"content_sha256":"5b966336a2772ce9505d0af493666307cf90683c63a1bbd6e1f65b7031f41032","schema_version":"1.0","event_id":"sha256:5b966336a2772ce9505d0af493666307cf90683c63a1bbd6e1f65b7031f41032"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/bundle.json","state_url":"https://pith.science/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T16:44:19Z","links":{"resolver":"https://pith.science/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP","bundle":"https://pith.science/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/bundle.json","state":"https://pith.science/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/5KPGZMSGLAKP2S3GKBT6LT2CUP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:5KPGZMSGLAKP2S3GKBT6LT2CUP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6a115075347790140c75c3b5602d723e82fea9c54007bbdf60aa7eb58e9ad242","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-15T23:22:25Z","title_canon_sha256":"b304d892c3100a31658bf87507a869847f784c815dea6155d3720a655129ff46"},"schema_version":"1.0","source":{"id":"2506.12995","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.12995","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"arxiv_version","alias_value":"2506.12995v1","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.12995","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_12","alias_value":"5KPGZMSGLAKP","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_16","alias_value":"5KPGZMSGLAKP2S3G","created_at":"2026-07-05T11:22:03Z"},{"alias_kind":"pith_short_8","alias_value":"5KPGZMSG","created_at":"2026-07-05T11:22:03Z"}],"graph_snapshots":[{"event_id":"sha256:5b966336a2772ce9505d0af493666307cf90683c63a1bbd6e1f65b7031f41032","target":"graph","created_at":"2026-07-05T11:22:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.12995/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Open-source software (OSS) has become increasingly more popular across different domains. However, this rapid development and widespread adoption come with a security cost. The growing complexity and openness of OSS ecosystems have led to increased exposure to vulnerabilities and attack surfaces. This paper investigates the trends and patterns of reported vulnerabilities within OSS platforms, focusing on the implications of these findings for security practices. To understand the dynamics of OSS vulnerabilities, we analyze a comprehensive dataset comprising 31,267 unique vulnerability reports ","authors_text":"Amin Kharraz, Behzad Ousat, Seyed Ali Akhavani","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-15T23:22:25Z","title":"Open Source, Open Threats? Investigating Security Challenges in Open-Source Software"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.12995","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:923d279c43ce0cb803179ba5f52ac70e19d90633c5ccd6806eee49ca7ab65983","target":"record","created_at":"2026-07-05T11:22:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6a115075347790140c75c3b5602d723e82fea9c54007bbdf60aa7eb58e9ad242","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-15T23:22:25Z","title_canon_sha256":"b304d892c3100a31658bf87507a869847f784c815dea6155d3720a655129ff46"},"schema_version":"1.0","source":{"id":"2506.12995","kind":"arxiv","version":1}},"canonical_sha256":"ea9e6cb2465814fd4b665067e5cf42a3e8715b65453d9f999674db5d60e139c3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ea9e6cb2465814fd4b665067e5cf42a3e8715b65453d9f999674db5d60e139c3","first_computed_at":"2026-07-05T11:22:03.610292Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:22:03.610292Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"0Es3niQ2+js+5Hk93nS1nW+E/nYsdUFjf3Wl+ge9DuaV+FPhvaQzY6mcMTXpwBiuaws1K3uvRRu4YD8ECBQrCA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:22:03.610811Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.12995","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:923d279c43ce0cb803179ba5f52ac70e19d90633c5ccd6806eee49ca7ab65983","sha256:5b966336a2772ce9505d0af493666307cf90683c63a1bbd6e1f65b7031f41032"],"state_sha256":"a3f4c95639be384068c72168b3e0e92009a7dccc8f4d495e36635b00d954ed0c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UD9+B2VCX6aEWbiYxVb4FXI0chSrCr1FjB5vVnAQI2pDLI53m7L6SKtN544EKOS8fSRPfasmUiHXKl0+SPrkCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T16:44:19.012767Z","bundle_sha256":"494dfb192cc5a37b56fbada1cec4c17f13157502e7cb32295524d8fa397f6d0f"}}