{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:EE44L5K6FGPGF4J6MRX6UVT3SG","short_pith_number":"pith:EE44L5K6","canonical_record":{"source":{"id":"2504.14026","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-18T18:31:31Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7936569ec271a0ec061fcb238d23d91120957f2c2f1b717151dd6a194ac549ea","abstract_canon_sha256":"e22e75fa211c68c2501e6c2567ff42b5e281d56aaa9ed390937ea200bfee5331"},"schema_version":"1.0"},"canonical_sha256":"2139c5f55e299e62f13e646fea567b91b6830a7b78ca2b5a5e04a7e81ef98dd5","source":{"kind":"arxiv","id":"2504.14026","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.14026","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"arxiv_version","alias_value":"2504.14026v2","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.14026","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_12","alias_value":"EE44L5K6FGPG","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_16","alias_value":"EE44L5K6FGPGF4J6","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_8","alias_value":"EE44L5K6","created_at":"2026-07-05T11:47:22Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:EE44L5K6FGPGF4J6MRX6UVT3SG","target":"record","payload":{"canonical_record":{"source":{"id":"2504.14026","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-18T18:31:31Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7936569ec271a0ec061fcb238d23d91120957f2c2f1b717151dd6a194ac549ea","abstract_canon_sha256":"e22e75fa211c68c2501e6c2567ff42b5e281d56aaa9ed390937ea200bfee5331"},"schema_version":"1.0"},"canonical_sha256":"2139c5f55e299e62f13e646fea567b91b6830a7b78ca2b5a5e04a7e81ef98dd5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:47:22.063333Z","signature_b64":"3Brgrov+3e14AEpLsZVtVOrSUcieo3qgWgnwoNrakbTkzQABGZi1dCwNzGTUFIvAgNa5XBJz7jDQ/cMsq/jtCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2139c5f55e299e62f13e646fea567b91b6830a7b78ca2b5a5e04a7e81ef98dd5","last_reissued_at":"2026-07-05T11:47:22.062770Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:47:22.062770Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2504.14026","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:47:22Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DTyHzoC04Vy3WJllsZ/V8G6Bz0rHmlVC/x5KhqxqhE2eoSrvBPBwv3aUisKVzOh42hqkpL2eRbo6y7bwkQePBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T03:41:51.681229Z"},"content_sha256":"cacacfa913f791f548716eb34b8cda79d30b8a357be66185115e74d97200bb4c","schema_version":"1.0","event_id":"sha256:cacacfa913f791f548716eb34b8cda79d30b8a357be66185115e74d97200bb4c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:EE44L5K6FGPGF4J6MRX6UVT3SG","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.SE","authors_text":"Imranur Rahman, Laurie Williams, Nusrat Zahan","submitted_at":"2025-04-18T18:31:31Z","abstract_excerpt":"Practitioners often struggle with the overwhelming number of security practices outlined in cybersecurity frameworks for risk mitigation. Given the limited budget, time, and resources, practitioners want to prioritize the adoption of security practices based on empirical evidence. The goal of this study is to assist practitioners and policymakers in making informed decisions on which security practices to adopt by evaluating the relationship between software security practices adoption and security outcome metrics. To do this, we analyzed the adoption of security practices and their impact on "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.14026","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.14026/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:47:22Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ju14/ab1O99JB4oF8bIMGt8uSP9OXUAFkFT1/pMIbOpmyiT4OI+P043mUURVYxCLiI/fejBkvcUq+scwzpMpCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T03:41:51.681766Z"},"content_sha256":"ab9966f1cf6a6b86d8b2244eee64eaa0f556f48ac44c23b73ccb4f128b7f1a02","schema_version":"1.0","event_id":"sha256:ab9966f1cf6a6b86d8b2244eee64eaa0f556f48ac44c23b73ccb4f128b7f1a02"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/bundle.json","state_url":"https://pith.science/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-22T03:41:51Z","links":{"resolver":"https://pith.science/pith/EE44L5K6FGPGF4J6MRX6UVT3SG","bundle":"https://pith.science/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/bundle.json","state":"https://pith.science/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/state.json","well_known_bundle":"https://pith.science/.well-known/pith/EE44L5K6FGPGF4J6MRX6UVT3SG/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:EE44L5K6FGPGF4J6MRX6UVT3SG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e22e75fa211c68c2501e6c2567ff42b5e281d56aaa9ed390937ea200bfee5331","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-18T18:31:31Z","title_canon_sha256":"7936569ec271a0ec061fcb238d23d91120957f2c2f1b717151dd6a194ac549ea"},"schema_version":"1.0","source":{"id":"2504.14026","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.14026","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"arxiv_version","alias_value":"2504.14026v2","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.14026","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_12","alias_value":"EE44L5K6FGPG","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_16","alias_value":"EE44L5K6FGPGF4J6","created_at":"2026-07-05T11:47:22Z"},{"alias_kind":"pith_short_8","alias_value":"EE44L5K6","created_at":"2026-07-05T11:47:22Z"}],"graph_snapshots":[{"event_id":"sha256:ab9966f1cf6a6b86d8b2244eee64eaa0f556f48ac44c23b73ccb4f128b7f1a02","target":"graph","created_at":"2026-07-05T11:47:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.14026/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Practitioners often struggle with the overwhelming number of security practices outlined in cybersecurity frameworks for risk mitigation. Given the limited budget, time, and resources, practitioners want to prioritize the adoption of security practices based on empirical evidence. The goal of this study is to assist practitioners and policymakers in making informed decisions on which security practices to adopt by evaluating the relationship between software security practices adoption and security outcome metrics. To do this, we analyzed the adoption of security practices and their impact on ","authors_text":"Imranur Rahman, Laurie Williams, Nusrat Zahan","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-18T18:31:31Z","title":"Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.14026","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cacacfa913f791f548716eb34b8cda79d30b8a357be66185115e74d97200bb4c","target":"record","created_at":"2026-07-05T11:47:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e22e75fa211c68c2501e6c2567ff42b5e281d56aaa9ed390937ea200bfee5331","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-18T18:31:31Z","title_canon_sha256":"7936569ec271a0ec061fcb238d23d91120957f2c2f1b717151dd6a194ac549ea"},"schema_version":"1.0","source":{"id":"2504.14026","kind":"arxiv","version":2}},"canonical_sha256":"2139c5f55e299e62f13e646fea567b91b6830a7b78ca2b5a5e04a7e81ef98dd5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2139c5f55e299e62f13e646fea567b91b6830a7b78ca2b5a5e04a7e81ef98dd5","first_computed_at":"2026-07-05T11:47:22.062770Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:47:22.062770Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3Brgrov+3e14AEpLsZVtVOrSUcieo3qgWgnwoNrakbTkzQABGZi1dCwNzGTUFIvAgNa5XBJz7jDQ/cMsq/jtCA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:47:22.063333Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.14026","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cacacfa913f791f548716eb34b8cda79d30b8a357be66185115e74d97200bb4c","sha256:ab9966f1cf6a6b86d8b2244eee64eaa0f556f48ac44c23b73ccb4f128b7f1a02"],"state_sha256":"051157abe1bc91c33225c7d7428b2f1767ba3a16cc8c8a7805a7ea987b7af1ac"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9NEbKFbENMpD3wLnYnIjzyIFdouX5df9/fZUi8mtw6jJf/i07qxJ2NnM4bnIeNsynESogDDRB2yyOcN1yiWMAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-22T03:41:51.686939Z","bundle_sha256":"35918c3326e956a6193f5ce6787a2c083f672c8a7a0828ed620a2d2ed92183f6"}}