{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:KR65NR36ZTEZ7RPRE43PS6POJN","short_pith_number":"pith:KR65NR36","canonical_record":{"source":{"id":"2202.13953","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-02-28T17:08:09Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"1731c88f80a37ec9d05a7ab00d995bcae32af76304b76257cabf41e504ca4221","abstract_canon_sha256":"d8e10cd9419154089933ef97127566c2a4828b4925aa3fcab94940b0f2347a32"},"schema_version":"1.0"},"canonical_sha256":"547dd6c77eccc99fc5f12736f979ee4b71694252295834315bad5c950afa841c","source":{"kind":"arxiv","id":"2202.13953","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2202.13953","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"arxiv_version","alias_value":"2202.13953v1","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2202.13953","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_12","alias_value":"KR65NR36ZTEZ","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_16","alias_value":"KR65NR36ZTEZ7RPR","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_8","alias_value":"KR65NR36","created_at":"2026-07-05T04:00:35Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:KR65NR36ZTEZ7RPRE43PS6POJN","target":"record","payload":{"canonical_record":{"source":{"id":"2202.13953","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-02-28T17:08:09Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"1731c88f80a37ec9d05a7ab00d995bcae32af76304b76257cabf41e504ca4221","abstract_canon_sha256":"d8e10cd9419154089933ef97127566c2a4828b4925aa3fcab94940b0f2347a32"},"schema_version":"1.0"},"canonical_sha256":"547dd6c77eccc99fc5f12736f979ee4b71694252295834315bad5c950afa841c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:00:35.631251Z","signature_b64":"VEKcuwVSjxpMKlHUp1O9/P2M8Yu5Rj3RFM09rwu3AVGWeb+jYf60YQeb/NHsxFdfS1hEKSwjynaP2OkBuuBFDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"547dd6c77eccc99fc5f12736f979ee4b71694252295834315bad5c950afa841c","last_reissued_at":"2026-07-05T04:00:35.630780Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:00:35.630780Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2202.13953","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:00:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ajh2Ao0hBg0EbR9QrjsX5ZFPOIrvFtV9yCnFSFxk8ddtHmt76Tjpoz0mP6rA2iUHWzu8hpF5dSv1FC405GACAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T09:03:29.326336Z"},"content_sha256":"1b444ac9ebea41ea50594d4874be796ac7919a1f7914623df9068f1e29d50bf1","schema_version":"1.0","event_id":"sha256:1b444ac9ebea41ea50594d4874be796ac7919a1f7914623df9068f1e29d50bf1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:KR65NR36ZTEZ7RPRE43PS6POJN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Practical Automated Detection of Malicious npm Packages","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Adriana Sejfia, Max Sch\\\"afer","submitted_at":"2022-02-28T17:08:09Z","abstract_excerpt":"The npm registry is one of the pillars of the JavaScript and TypeScript ecosystems, hosting over 1.7 million packages ranging from simple utility libraries to complex frameworks and entire applications. Due to the overwhelming popularity of npm, it has become a prime target for malicious actors, who publish new packages or compromise existing packages to introduce malware that tampers with or exfiltrates sensitive data from users who install either these packages or any package that (transitively) depends on them. Defending against such attacks is essential to maintaining the integrity of the "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2202.13953","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2202.13953/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:00:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yDPSh3i8FPCkPDhTtSuQh2tk6eO2EepbswVKe/Hb6SZeL50QW+W7B0VAlF5EWARvNye3hUs0R+yFDFYBnECSCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T09:03:29.327206Z"},"content_sha256":"561e78504577aca7a75969f4d5acf31455a0344df31a793423ab2de118e4af9f","schema_version":"1.0","event_id":"sha256:561e78504577aca7a75969f4d5acf31455a0344df31a793423ab2de118e4af9f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KR65NR36ZTEZ7RPRE43PS6POJN/bundle.json","state_url":"https://pith.science/pith/KR65NR36ZTEZ7RPRE43PS6POJN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KR65NR36ZTEZ7RPRE43PS6POJN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-19T09:03:29Z","links":{"resolver":"https://pith.science/pith/KR65NR36ZTEZ7RPRE43PS6POJN","bundle":"https://pith.science/pith/KR65NR36ZTEZ7RPRE43PS6POJN/bundle.json","state":"https://pith.science/pith/KR65NR36ZTEZ7RPRE43PS6POJN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KR65NR36ZTEZ7RPRE43PS6POJN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:KR65NR36ZTEZ7RPRE43PS6POJN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d8e10cd9419154089933ef97127566c2a4828b4925aa3fcab94940b0f2347a32","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-02-28T17:08:09Z","title_canon_sha256":"1731c88f80a37ec9d05a7ab00d995bcae32af76304b76257cabf41e504ca4221"},"schema_version":"1.0","source":{"id":"2202.13953","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2202.13953","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"arxiv_version","alias_value":"2202.13953v1","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2202.13953","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_12","alias_value":"KR65NR36ZTEZ","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_16","alias_value":"KR65NR36ZTEZ7RPR","created_at":"2026-07-05T04:00:35Z"},{"alias_kind":"pith_short_8","alias_value":"KR65NR36","created_at":"2026-07-05T04:00:35Z"}],"graph_snapshots":[{"event_id":"sha256:561e78504577aca7a75969f4d5acf31455a0344df31a793423ab2de118e4af9f","target":"graph","created_at":"2026-07-05T04:00:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2202.13953/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The npm registry is one of the pillars of the JavaScript and TypeScript ecosystems, hosting over 1.7 million packages ranging from simple utility libraries to complex frameworks and entire applications. Due to the overwhelming popularity of npm, it has become a prime target for malicious actors, who publish new packages or compromise existing packages to introduce malware that tampers with or exfiltrates sensitive data from users who install either these packages or any package that (transitively) depends on them. Defending against such attacks is essential to maintaining the integrity of the ","authors_text":"Adriana Sejfia, Max Sch\\\"afer","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-02-28T17:08:09Z","title":"Practical Automated Detection of Malicious npm Packages"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2202.13953","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1b444ac9ebea41ea50594d4874be796ac7919a1f7914623df9068f1e29d50bf1","target":"record","created_at":"2026-07-05T04:00:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d8e10cd9419154089933ef97127566c2a4828b4925aa3fcab94940b0f2347a32","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-02-28T17:08:09Z","title_canon_sha256":"1731c88f80a37ec9d05a7ab00d995bcae32af76304b76257cabf41e504ca4221"},"schema_version":"1.0","source":{"id":"2202.13953","kind":"arxiv","version":1}},"canonical_sha256":"547dd6c77eccc99fc5f12736f979ee4b71694252295834315bad5c950afa841c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"547dd6c77eccc99fc5f12736f979ee4b71694252295834315bad5c950afa841c","first_computed_at":"2026-07-05T04:00:35.630780Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:00:35.630780Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"VEKcuwVSjxpMKlHUp1O9/P2M8Yu5Rj3RFM09rwu3AVGWeb+jYf60YQeb/NHsxFdfS1hEKSwjynaP2OkBuuBFDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T04:00:35.631251Z","signed_message":"canonical_sha256_bytes"},"source_id":"2202.13953","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1b444ac9ebea41ea50594d4874be796ac7919a1f7914623df9068f1e29d50bf1","sha256:561e78504577aca7a75969f4d5acf31455a0344df31a793423ab2de118e4af9f"],"state_sha256":"d799f377367c02b53de045f43925164886401766023e7e93a6e6bbbd661134c1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"S2ndtWd5kfcgnzjI0h2I8veSElXgiB6Bs6Uhd3PVNJwOxIm5KUQMdbsVhBEMVfEMrGZsFSobjetsDRTlpPhrCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-19T09:03:29.336401Z","bundle_sha256":"4daf1455677bc2db4aea2f52abdd945a48555bd76163ee0999da38c42f5d3ac2"}}