{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:HIP6QRLRJAOB5W5MTY4BG522KN","short_pith_number":"pith:HIP6QRLR","canonical_record":{"source":{"id":"2406.11362","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-06-17T09:33:08Z","cross_cats_sorted":[],"title_canon_sha256":"0f70af7d017b50ee3662e27a5a5f521f6708409931b68323d17f09b609a67558","abstract_canon_sha256":"0098a81e97d755fd0b10b248f50c8185fe6ff37624c6a8acfd32c0675563ff24"},"schema_version":"1.0"},"canonical_sha256":"3a1fe84571481c1edbac9e3813775a53694bb5c1a8a9523fa89bd03039845aa8","source":{"kind":"arxiv","id":"2406.11362","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.11362","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"arxiv_version","alias_value":"2406.11362v1","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.11362","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_12","alias_value":"HIP6QRLRJAOB","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_16","alias_value":"HIP6QRLRJAOB5W5M","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_8","alias_value":"HIP6QRLR","created_at":"2026-07-05T08:32:52Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:HIP6QRLRJAOB5W5MTY4BG522KN","target":"record","payload":{"canonical_record":{"source":{"id":"2406.11362","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-06-17T09:33:08Z","cross_cats_sorted":[],"title_canon_sha256":"0f70af7d017b50ee3662e27a5a5f521f6708409931b68323d17f09b609a67558","abstract_canon_sha256":"0098a81e97d755fd0b10b248f50c8185fe6ff37624c6a8acfd32c0675563ff24"},"schema_version":"1.0"},"canonical_sha256":"3a1fe84571481c1edbac9e3813775a53694bb5c1a8a9523fa89bd03039845aa8","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:32:52.412947Z","signature_b64":"Ti0YFqeXKm0F6JPl/M0toskNLhd0HijHxbbjC4XxwzpAccA8Ed45E60HVvMd/4Yfyf/kmZH2bWgrJjpa8IsWAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3a1fe84571481c1edbac9e3813775a53694bb5c1a8a9523fa89bd03039845aa8","last_reissued_at":"2026-07-05T08:32:52.412560Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:32:52.412560Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2406.11362","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:32:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Q5nrQtVx0X9O39lXiSGP+C2Wu4+xI11PHABmoiBG5gXEM5AL2owAm1+CzeIIJmJJimuoAuNCPNcpAtG1SazgDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:47:04.000302Z"},"content_sha256":"d2a946d833a60b40c0ce6d6c24435178b1ff743c650bc5938ac80a32f942ad0d","schema_version":"1.0","event_id":"sha256:d2a946d833a60b40c0ce6d6c24435178b1ff743c650bc5938ac80a32f942ad0d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:HIP6QRLRJAOB5W5MTY4BG522KN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Characterising Contributions that Coincide with Vulnerability Mitigation in NPM Libraries","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Ali Ouni, Christoph Treude, Hathaichanok Damrongsiri, Raula Gaikovina Kula, Ruksit Rojpaisarnkit","submitted_at":"2024-06-17T09:33:08Z","abstract_excerpt":"With the urgent need to secure supply chains among Open Source libraries, attention has focused on mitigating vulnerabilities detected in these libraries. Although awareness has improved recently, most studies still report delays in the mitigation process. This suggests that developers still have to deal with other contributions that occur during the period of fixing vulnerabilities, such as coinciding Pull Requests (PRs) and Issues, yet the impact of these contributions remains unclear. To characterize these contributions, we conducted a mixed-method empirical study to analyze NPM GitHub proj"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.11362","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2406.11362/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:32:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Z2Smyz2coFq8r9Hb8iJPENzKbMKH7tRL/BFa/kxk05/S0lg/yBoTRfsmbwmHFAVdMEqIJ5OJ0/oE+qkVJI5IBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:47:04.000699Z"},"content_sha256":"95f3edd21273e7727fe64a0801fe9ee647b4731d142e6ea6d6293b9168c7c8ae","schema_version":"1.0","event_id":"sha256:95f3edd21273e7727fe64a0801fe9ee647b4731d142e6ea6d6293b9168c7c8ae"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HIP6QRLRJAOB5W5MTY4BG522KN/bundle.json","state_url":"https://pith.science/pith/HIP6QRLRJAOB5W5MTY4BG522KN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HIP6QRLRJAOB5W5MTY4BG522KN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T20:47:04Z","links":{"resolver":"https://pith.science/pith/HIP6QRLRJAOB5W5MTY4BG522KN","bundle":"https://pith.science/pith/HIP6QRLRJAOB5W5MTY4BG522KN/bundle.json","state":"https://pith.science/pith/HIP6QRLRJAOB5W5MTY4BG522KN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HIP6QRLRJAOB5W5MTY4BG522KN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:HIP6QRLRJAOB5W5MTY4BG522KN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0098a81e97d755fd0b10b248f50c8185fe6ff37624c6a8acfd32c0675563ff24","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-06-17T09:33:08Z","title_canon_sha256":"0f70af7d017b50ee3662e27a5a5f521f6708409931b68323d17f09b609a67558"},"schema_version":"1.0","source":{"id":"2406.11362","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.11362","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"arxiv_version","alias_value":"2406.11362v1","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.11362","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_12","alias_value":"HIP6QRLRJAOB","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_16","alias_value":"HIP6QRLRJAOB5W5M","created_at":"2026-07-05T08:32:52Z"},{"alias_kind":"pith_short_8","alias_value":"HIP6QRLR","created_at":"2026-07-05T08:32:52Z"}],"graph_snapshots":[{"event_id":"sha256:95f3edd21273e7727fe64a0801fe9ee647b4731d142e6ea6d6293b9168c7c8ae","target":"graph","created_at":"2026-07-05T08:32:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2406.11362/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the urgent need to secure supply chains among Open Source libraries, attention has focused on mitigating vulnerabilities detected in these libraries. Although awareness has improved recently, most studies still report delays in the mitigation process. This suggests that developers still have to deal with other contributions that occur during the period of fixing vulnerabilities, such as coinciding Pull Requests (PRs) and Issues, yet the impact of these contributions remains unclear. To characterize these contributions, we conducted a mixed-method empirical study to analyze NPM GitHub proj","authors_text":"Ali Ouni, Christoph Treude, Hathaichanok Damrongsiri, Raula Gaikovina Kula, Ruksit Rojpaisarnkit","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-06-17T09:33:08Z","title":"Characterising Contributions that Coincide with Vulnerability Mitigation in NPM Libraries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.11362","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d2a946d833a60b40c0ce6d6c24435178b1ff743c650bc5938ac80a32f942ad0d","target":"record","created_at":"2026-07-05T08:32:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0098a81e97d755fd0b10b248f50c8185fe6ff37624c6a8acfd32c0675563ff24","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2024-06-17T09:33:08Z","title_canon_sha256":"0f70af7d017b50ee3662e27a5a5f521f6708409931b68323d17f09b609a67558"},"schema_version":"1.0","source":{"id":"2406.11362","kind":"arxiv","version":1}},"canonical_sha256":"3a1fe84571481c1edbac9e3813775a53694bb5c1a8a9523fa89bd03039845aa8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3a1fe84571481c1edbac9e3813775a53694bb5c1a8a9523fa89bd03039845aa8","first_computed_at":"2026-07-05T08:32:52.412560Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:32:52.412560Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Ti0YFqeXKm0F6JPl/M0toskNLhd0HijHxbbjC4XxwzpAccA8Ed45E60HVvMd/4Yfyf/kmZH2bWgrJjpa8IsWAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T08:32:52.412947Z","signed_message":"canonical_sha256_bytes"},"source_id":"2406.11362","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d2a946d833a60b40c0ce6d6c24435178b1ff743c650bc5938ac80a32f942ad0d","sha256:95f3edd21273e7727fe64a0801fe9ee647b4731d142e6ea6d6293b9168c7c8ae"],"state_sha256":"4446c9a758ce05f47258944b1e9e81f4323876927fccbe88331ebe3ce1a89546"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iiXSOpWrTk3LlZlx+n0HcSHfoAc3oHkbbpDEAugdvN+Jea3604bzXVvM6mXdr+vow2h4WM9+48FU4NDGUxWRAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T20:47:04.002680Z","bundle_sha256":"06c1a36b9722930226d7703d7e9ecfbf8d994c9dda403808305f66ceac29ebde"}}