{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:HESR5FV3BPUVGFOHPWPM4NKN4T","short_pith_number":"pith:HESR5FV3","canonical_record":{"source":{"id":"2509.04260","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-04T14:38:28Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"1c20754da11433fc4460a3649e4a248c0fdf29396acb121d8f23a071aadd23e3","abstract_canon_sha256":"1150402407d96fa7a866eec883dd6e8a03bbdab4c0fe04621e2e125224034d6c"},"schema_version":"1.0"},"canonical_sha256":"39251e96bb0be95315c77d9ece354de4c5c4f41481d2f3a077c24c7df43061ed","source":{"kind":"arxiv","id":"2509.04260","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.04260","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"arxiv_version","alias_value":"2509.04260v1","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.04260","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_12","alias_value":"HESR5FV3BPUV","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_16","alias_value":"HESR5FV3BPUVGFOH","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_8","alias_value":"HESR5FV3","created_at":"2026-07-05T12:04:56Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:HESR5FV3BPUVGFOHPWPM4NKN4T","target":"record","payload":{"canonical_record":{"source":{"id":"2509.04260","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-04T14:38:28Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"1c20754da11433fc4460a3649e4a248c0fdf29396acb121d8f23a071aadd23e3","abstract_canon_sha256":"1150402407d96fa7a866eec883dd6e8a03bbdab4c0fe04621e2e125224034d6c"},"schema_version":"1.0"},"canonical_sha256":"39251e96bb0be95315c77d9ece354de4c5c4f41481d2f3a077c24c7df43061ed","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:04:56.447424Z","signature_b64":"3xQBP7nxQ5yd5aoLIbcOpSiDQfTNoDYCf8uWa/el0QXfplu+Rn3xCZRxBKQHYkPcmRWYl68D2P9lvTFl1xYwCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"39251e96bb0be95315c77d9ece354de4c5c4f41481d2f3a077c24c7df43061ed","last_reissued_at":"2026-07-05T12:04:56.446888Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:04:56.446888Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.04260","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:04:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"J8jS8vHwUzoUWS5D1PQwI8YBGW6L7dWRUqg/LaKnHBQtvDdNbJ18MpuULdsF7ubiWwFmYdcUWZ6MbGmP5oVxAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:08:38.232828Z"},"content_sha256":"69565e3f3d844c39e89ea2b5e1ca64039b194250f978ca1197e3ce68bb76fd06","schema_version":"1.0","event_id":"sha256:69565e3f3d844c39e89ea2b5e1ca64039b194250f978ca1197e3ce68bb76fd06"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:HESR5FV3BPUVGFOHPWPM4NKN4T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Empirical Study of Vulnerabilities in Python Packages and Their Detection","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI","cs.CR"],"primary_cat":"cs.SE","authors_text":"Haowei Quan, Junjie Wang, Terry Yue Zhuo, Xiao Chen, Xiaoning Du, Xinzhe Li","submitted_at":"2025-09-04T14:38:28Z","abstract_excerpt":"In the rapidly evolving software development landscape, Python stands out for its simplicity, versatility, and extensive ecosystem. Python packages, as units of organization, reusability, and distribution, have become a pressing concern, highlighted by the considerable number of vulnerability reports. As a scripting language, Python often cooperates with other languages for performance or interoperability. This adds complexity to the vulnerabilities inherent to Python packages, and the effectiveness of current vulnerability detection tools remains underexplored. This paper addresses these gaps"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.04260","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.04260/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:04:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"d6TyK7H3fIVItjbLS+e//xQpvb4f1BU9Ya+JkPI4gRuBWvzhdLawKS2VqxiJxl3Nk7djQi3+hYtMnawrNiXaBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T18:08:38.233392Z"},"content_sha256":"6db30f13ab247955c615ceed8cb254dd712f49e405b36d9cf33fd8029e38698b","schema_version":"1.0","event_id":"sha256:6db30f13ab247955c615ceed8cb254dd712f49e405b36d9cf33fd8029e38698b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/bundle.json","state_url":"https://pith.science/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T18:08:38Z","links":{"resolver":"https://pith.science/pith/HESR5FV3BPUVGFOHPWPM4NKN4T","bundle":"https://pith.science/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/bundle.json","state":"https://pith.science/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HESR5FV3BPUVGFOHPWPM4NKN4T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:HESR5FV3BPUVGFOHPWPM4NKN4T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1150402407d96fa7a866eec883dd6e8a03bbdab4c0fe04621e2e125224034d6c","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-04T14:38:28Z","title_canon_sha256":"1c20754da11433fc4460a3649e4a248c0fdf29396acb121d8f23a071aadd23e3"},"schema_version":"1.0","source":{"id":"2509.04260","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.04260","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"arxiv_version","alias_value":"2509.04260v1","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.04260","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_12","alias_value":"HESR5FV3BPUV","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_16","alias_value":"HESR5FV3BPUVGFOH","created_at":"2026-07-05T12:04:56Z"},{"alias_kind":"pith_short_8","alias_value":"HESR5FV3","created_at":"2026-07-05T12:04:56Z"}],"graph_snapshots":[{"event_id":"sha256:6db30f13ab247955c615ceed8cb254dd712f49e405b36d9cf33fd8029e38698b","target":"graph","created_at":"2026-07-05T12:04:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.04260/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In the rapidly evolving software development landscape, Python stands out for its simplicity, versatility, and extensive ecosystem. Python packages, as units of organization, reusability, and distribution, have become a pressing concern, highlighted by the considerable number of vulnerability reports. As a scripting language, Python often cooperates with other languages for performance or interoperability. This adds complexity to the vulnerabilities inherent to Python packages, and the effectiveness of current vulnerability detection tools remains underexplored. This paper addresses these gaps","authors_text":"Haowei Quan, Junjie Wang, Terry Yue Zhuo, Xiao Chen, Xiaoning Du, Xinzhe Li","cross_cats":["cs.AI","cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-04T14:38:28Z","title":"An Empirical Study of Vulnerabilities in Python Packages and Their Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.04260","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:69565e3f3d844c39e89ea2b5e1ca64039b194250f978ca1197e3ce68bb76fd06","target":"record","created_at":"2026-07-05T12:04:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1150402407d96fa7a866eec883dd6e8a03bbdab4c0fe04621e2e125224034d6c","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-09-04T14:38:28Z","title_canon_sha256":"1c20754da11433fc4460a3649e4a248c0fdf29396acb121d8f23a071aadd23e3"},"schema_version":"1.0","source":{"id":"2509.04260","kind":"arxiv","version":1}},"canonical_sha256":"39251e96bb0be95315c77d9ece354de4c5c4f41481d2f3a077c24c7df43061ed","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"39251e96bb0be95315c77d9ece354de4c5c4f41481d2f3a077c24c7df43061ed","first_computed_at":"2026-07-05T12:04:56.446888Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:04:56.446888Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3xQBP7nxQ5yd5aoLIbcOpSiDQfTNoDYCf8uWa/el0QXfplu+Rn3xCZRxBKQHYkPcmRWYl68D2P9lvTFl1xYwCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T12:04:56.447424Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.04260","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:69565e3f3d844c39e89ea2b5e1ca64039b194250f978ca1197e3ce68bb76fd06","sha256:6db30f13ab247955c615ceed8cb254dd712f49e405b36d9cf33fd8029e38698b"],"state_sha256":"8db5974f6b61808b1fd760fbde01306d0d981e1be13add84fdd17a3ff8bda707"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"sPZVioA3u0xcouCyJ4vEha6KQHHGMXVOtsyEG6tkil1UTp0phFTH6fCxdsj5QpNDuoMmvztMApHYBf1AJD2pDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T18:08:38.239778Z","bundle_sha256":"ba1bb44d6cbb3f1c114d46139053e256a9be8dcf2f5d21649f85921b72b95d8d"}}