{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:DAV77CEYCBYZ3JIVSZTZPY6GYX","short_pith_number":"pith:DAV77CEY","canonical_record":{"source":{"id":"2201.03981","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-01-11T14:51:46Z","cross_cats_sorted":[],"title_canon_sha256":"7335614120b130b862f4121d2d5b3cee9a031d399632723933ae6c90e23d6c30","abstract_canon_sha256":"41547aae72a446cef54e8a8882317be81c2072d01f2b0c4d7cd114f24da5b2dc"},"schema_version":"1.0"},"canonical_sha256":"182bff889810719da515966797e3c6c5c7eccef67a48ffc2ee063fe608725291","source":{"kind":"arxiv","id":"2201.03981","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2201.03981","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"arxiv_version","alias_value":"2201.03981v2","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2201.03981","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_12","alias_value":"DAV77CEYCBYZ","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_16","alias_value":"DAV77CEYCBYZ3JIV","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_8","alias_value":"DAV77CEY","created_at":"2026-07-05T04:51:54Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:DAV77CEYCBYZ3JIVSZTZPY6GYX","target":"record","payload":{"canonical_record":{"source":{"id":"2201.03981","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-01-11T14:51:46Z","cross_cats_sorted":[],"title_canon_sha256":"7335614120b130b862f4121d2d5b3cee9a031d399632723933ae6c90e23d6c30","abstract_canon_sha256":"41547aae72a446cef54e8a8882317be81c2072d01f2b0c4d7cd114f24da5b2dc"},"schema_version":"1.0"},"canonical_sha256":"182bff889810719da515966797e3c6c5c7eccef67a48ffc2ee063fe608725291","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:51:54.457007Z","signature_b64":"n0aX8PbkHlMRR8k3yBHP+3f4CciKwflWS5KC8Ry4SMaTNwbGfyRStXRZuxLmAFzIcbsOkYDO5EXPNx23MZPLAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"182bff889810719da515966797e3c6c5c7eccef67a48ffc2ee063fe608725291","last_reissued_at":"2026-07-05T04:51:54.456592Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:51:54.456592Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2201.03981","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:51:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"U+rlyjvMT+NWzlaXk0sIC6V+K4jlT2mFzd94Y2ZqaQPd3976tPWCDD4b8l4VuYGqDv0iQFcbmfHb9FiMQ4ssCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-02T15:16:59.289930Z"},"content_sha256":"52451905ebe61924fe853c2d9b645668d9e58fd4cc914ce122999ad8abdd61ff","schema_version":"1.0","event_id":"sha256:52451905ebe61924fe853c2d9b645668d9e58fd4cc914ce122999ad8abdd61ff"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:DAV77CEYCBYZ3JIVSZTZPY6GYX","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Bihuan Chen, Chengwei Liu, Lingling Fan, Sen Chen, Xin Peng, Yang Liu","submitted_at":"2022-01-11T14:51:46Z","abstract_excerpt":"Third-party libraries with rich functionalities facilitate the fast development of Node.js software, but also bring new security threats that vulnerabilities could be introduced through dependencies. In particular, the threats could be excessively amplified by transitive dependencies. Existing research either considers direct dependencies or reasoning transitive dependencies based on reachability analysis, which neglects the NPM-specific dependency resolution rules, resulting in wrongly resolved dependencies. Consequently, further fine-grained analysis, such as vulnerability propagation and th"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2201.03981","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2201.03981/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:51:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"j1tephJ0ZSwQm/iJjwmH3Y5uknTAfTW6O0JryLnwIeY/pW3MN1gKWlnGb8crWpEv4BaW9Z0F2o6nRF1fZQkmDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-02T15:16:59.290797Z"},"content_sha256":"4dcb5e4982e7f2db2f4230a39a085a55d504c5df6af85e033fe8296c76fe76b4","schema_version":"1.0","event_id":"sha256:4dcb5e4982e7f2db2f4230a39a085a55d504c5df6af85e033fe8296c76fe76b4"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/bundle.json","state_url":"https://pith.science/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-02T15:16:59Z","links":{"resolver":"https://pith.science/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX","bundle":"https://pith.science/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/bundle.json","state":"https://pith.science/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/state.json","well_known_bundle":"https://pith.science/.well-known/pith/DAV77CEYCBYZ3JIVSZTZPY6GYX/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:DAV77CEYCBYZ3JIVSZTZPY6GYX","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"41547aae72a446cef54e8a8882317be81c2072d01f2b0c4d7cd114f24da5b2dc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-01-11T14:51:46Z","title_canon_sha256":"7335614120b130b862f4121d2d5b3cee9a031d399632723933ae6c90e23d6c30"},"schema_version":"1.0","source":{"id":"2201.03981","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2201.03981","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"arxiv_version","alias_value":"2201.03981v2","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2201.03981","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_12","alias_value":"DAV77CEYCBYZ","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_16","alias_value":"DAV77CEYCBYZ3JIV","created_at":"2026-07-05T04:51:54Z"},{"alias_kind":"pith_short_8","alias_value":"DAV77CEY","created_at":"2026-07-05T04:51:54Z"}],"graph_snapshots":[{"event_id":"sha256:4dcb5e4982e7f2db2f4230a39a085a55d504c5df6af85e033fe8296c76fe76b4","target":"graph","created_at":"2026-07-05T04:51:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2201.03981/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Third-party libraries with rich functionalities facilitate the fast development of Node.js software, but also bring new security threats that vulnerabilities could be introduced through dependencies. In particular, the threats could be excessively amplified by transitive dependencies. Existing research either considers direct dependencies or reasoning transitive dependencies based on reachability analysis, which neglects the NPM-specific dependency resolution rules, resulting in wrongly resolved dependencies. Consequently, further fine-grained analysis, such as vulnerability propagation and th","authors_text":"Bihuan Chen, Chengwei Liu, Lingling Fan, Sen Chen, Xin Peng, Yang Liu","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-01-11T14:51:46Z","title":"Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2201.03981","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:52451905ebe61924fe853c2d9b645668d9e58fd4cc914ce122999ad8abdd61ff","target":"record","created_at":"2026-07-05T04:51:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"41547aae72a446cef54e8a8882317be81c2072d01f2b0c4d7cd114f24da5b2dc","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-01-11T14:51:46Z","title_canon_sha256":"7335614120b130b862f4121d2d5b3cee9a031d399632723933ae6c90e23d6c30"},"schema_version":"1.0","source":{"id":"2201.03981","kind":"arxiv","version":2}},"canonical_sha256":"182bff889810719da515966797e3c6c5c7eccef67a48ffc2ee063fe608725291","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"182bff889810719da515966797e3c6c5c7eccef67a48ffc2ee063fe608725291","first_computed_at":"2026-07-05T04:51:54.456592Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:51:54.456592Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"n0aX8PbkHlMRR8k3yBHP+3f4CciKwflWS5KC8Ry4SMaTNwbGfyRStXRZuxLmAFzIcbsOkYDO5EXPNx23MZPLAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T04:51:54.457007Z","signed_message":"canonical_sha256_bytes"},"source_id":"2201.03981","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:52451905ebe61924fe853c2d9b645668d9e58fd4cc914ce122999ad8abdd61ff","sha256:4dcb5e4982e7f2db2f4230a39a085a55d504c5df6af85e033fe8296c76fe76b4"],"state_sha256":"77314de9c9464c198021bbab71199cc8dc60d7957052828acff21898f86e99ed"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZPEn+TluCGFmWHnE/PvMAQtry7jNXOXtyKQ/cP//hWvBA+W6OHnntvbJEwadvB/b6zyShbzfHPHJH3mGhWM5BQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-02T15:16:59.294903Z","bundle_sha256":"ea994690e322adf3ef7c366bb669e7cc098f72418722a7b2bf85cea277f59de4"}}