{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:LZXKD6YOSE2HMI2VNQLUR6HPWV","short_pith_number":"pith:LZXKD6YO","canonical_record":{"source":{"id":"2403.08334","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-03-13T08:38:21Z","cross_cats_sorted":[],"title_canon_sha256":"2310f600eb1c59ab7a2cd7f353dc633dd9f75f6e7a6acb75bf025fb0c5713aa7","abstract_canon_sha256":"9bd7efe2e59aacb97afaa70f201c55d25d89843a3819dbbd3a3ea87aba9e066c"},"schema_version":"1.0"},"canonical_sha256":"5e6ea1fb0e91347623556c1748f8efb5405a39911bbc67409c2b14e270f7f035","source":{"kind":"arxiv","id":"2403.08334","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.08334","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"arxiv_version","alias_value":"2403.08334v1","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.08334","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_12","alias_value":"LZXKD6YOSE2H","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_16","alias_value":"LZXKD6YOSE2HMI2V","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_8","alias_value":"LZXKD6YO","created_at":"2026-07-05T07:55:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:LZXKD6YOSE2HMI2VNQLUR6HPWV","target":"record","payload":{"canonical_record":{"source":{"id":"2403.08334","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-03-13T08:38:21Z","cross_cats_sorted":[],"title_canon_sha256":"2310f600eb1c59ab7a2cd7f353dc633dd9f75f6e7a6acb75bf025fb0c5713aa7","abstract_canon_sha256":"9bd7efe2e59aacb97afaa70f201c55d25d89843a3819dbbd3a3ea87aba9e066c"},"schema_version":"1.0"},"canonical_sha256":"5e6ea1fb0e91347623556c1748f8efb5405a39911bbc67409c2b14e270f7f035","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:55:37.570294Z","signature_b64":"YUesW0yMyPQ/Xmvb20Wguj80IlhcCqnqeeDgSxXE/9miVoSuQGc9dIuH518w5ZglP9R/bd3GLvgoK/wK4ef5Ag==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5e6ea1fb0e91347623556c1748f8efb5405a39911bbc67409c2b14e270f7f035","last_reissued_at":"2026-07-05T07:55:37.569789Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:55:37.569789Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2403.08334","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:55:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/pl09E+GVNa5PFYy1nawlXoRO710lRjkaSCLfkoTqtn2y7k3MuXQS27DZvHGXg6s07wzn4Uk2PlNxHMY75RnAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T10:07:38.080742Z"},"content_sha256":"f461b90a455f41f2fd0b7e4db21c159fa1005d09f73ce01bbceabb82026aff9a","schema_version":"1.0","event_id":"sha256:f461b90a455f41f2fd0b7e4db21c159fa1005d09f73ce01bbceabb82026aff9a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:LZXKD6YOSE2HMI2VNQLUR6HPWV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"(2) Huawei Technologies), Cheng Huang (1), Jiaxuan Han (1), Junren Chen (1), Lei Shi (2) ((1) Sichuan University, Lingzi Li (1), Nannan Wang (1), Qianchong Zhao (1), Siqi Sun (1), Zhen Yang (1), Ziyan Wang (1)","submitted_at":"2024-03-13T08:38:21Z","abstract_excerpt":"With the growing popularity of modularity in software development comes the rise of package managers and language ecosystems. Among them, npm stands out as the most extensive package manager, hosting more than 2 million third-party open-source packages that greatly simplify the process of building code. However, this openness also brings security risks, as evidenced by numerous package poisoning incidents.\n  In this paper, we synchronize a local package cache containing more than 3.4 million packages in near real-time to give us access to more package code details. Further, we perform manual i"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.08334","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2403.08334/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:55:37Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zb3Fq7zlWhPNlZVw0F6Z6+N8flhPFioxrH5+Z5UIbqQQR9lyBB6F4p8shzQvpKoUTvKfApWElpF2IbOHyxwyCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T10:07:38.081381Z"},"content_sha256":"8c8879566ec36565c3dcf922fb766e4d1149b2f9f846c5533d47962c508721d8","schema_version":"1.0","event_id":"sha256:8c8879566ec36565c3dcf922fb766e4d1149b2f9f846c5533d47962c508721d8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/bundle.json","state_url":"https://pith.science/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-19T10:07:38Z","links":{"resolver":"https://pith.science/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV","bundle":"https://pith.science/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/bundle.json","state":"https://pith.science/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LZXKD6YOSE2HMI2VNQLUR6HPWV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:LZXKD6YOSE2HMI2VNQLUR6HPWV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9bd7efe2e59aacb97afaa70f201c55d25d89843a3819dbbd3a3ea87aba9e066c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-03-13T08:38:21Z","title_canon_sha256":"2310f600eb1c59ab7a2cd7f353dc633dd9f75f6e7a6acb75bf025fb0c5713aa7"},"schema_version":"1.0","source":{"id":"2403.08334","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.08334","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"arxiv_version","alias_value":"2403.08334v1","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.08334","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_12","alias_value":"LZXKD6YOSE2H","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_16","alias_value":"LZXKD6YOSE2HMI2V","created_at":"2026-07-05T07:55:37Z"},{"alias_kind":"pith_short_8","alias_value":"LZXKD6YO","created_at":"2026-07-05T07:55:37Z"}],"graph_snapshots":[{"event_id":"sha256:8c8879566ec36565c3dcf922fb766e4d1149b2f9f846c5533d47962c508721d8","target":"graph","created_at":"2026-07-05T07:55:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2403.08334/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the growing popularity of modularity in software development comes the rise of package managers and language ecosystems. Among them, npm stands out as the most extensive package manager, hosting more than 2 million third-party open-source packages that greatly simplify the process of building code. However, this openness also brings security risks, as evidenced by numerous package poisoning incidents.\n  In this paper, we synchronize a local package cache containing more than 3.4 million packages in near real-time to give us access to more package code details. Further, we perform manual i","authors_text":"(2) Huawei Technologies), Cheng Huang (1), Jiaxuan Han (1), Junren Chen (1), Lei Shi (2) ((1) Sichuan University, Lingzi Li (1), Nannan Wang (1), Qianchong Zhao (1), Siqi Sun (1), Zhen Yang (1), Ziyan Wang (1)","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-03-13T08:38:21Z","title":"DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.08334","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f461b90a455f41f2fd0b7e4db21c159fa1005d09f73ce01bbceabb82026aff9a","target":"record","created_at":"2026-07-05T07:55:37Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9bd7efe2e59aacb97afaa70f201c55d25d89843a3819dbbd3a3ea87aba9e066c","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-03-13T08:38:21Z","title_canon_sha256":"2310f600eb1c59ab7a2cd7f353dc633dd9f75f6e7a6acb75bf025fb0c5713aa7"},"schema_version":"1.0","source":{"id":"2403.08334","kind":"arxiv","version":1}},"canonical_sha256":"5e6ea1fb0e91347623556c1748f8efb5405a39911bbc67409c2b14e270f7f035","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5e6ea1fb0e91347623556c1748f8efb5405a39911bbc67409c2b14e270f7f035","first_computed_at":"2026-07-05T07:55:37.569789Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:55:37.569789Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"YUesW0yMyPQ/Xmvb20Wguj80IlhcCqnqeeDgSxXE/9miVoSuQGc9dIuH518w5ZglP9R/bd3GLvgoK/wK4ef5Ag==","signature_status":"signed_v1","signed_at":"2026-07-05T07:55:37.570294Z","signed_message":"canonical_sha256_bytes"},"source_id":"2403.08334","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f461b90a455f41f2fd0b7e4db21c159fa1005d09f73ce01bbceabb82026aff9a","sha256:8c8879566ec36565c3dcf922fb766e4d1149b2f9f846c5533d47962c508721d8"],"state_sha256":"7d3380fa935d53dd8aa6669cb6945f4c5978db9ae757bd14a84f37b3f8b7068b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"R7621IRyAgMvs3jVgBQfanQ98eK0tkvrWRfS2UqygO6x+kDjqN5zpbDcwwRmRCRCSINoaeyIVpz69fid2ToHAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-19T10:07:38.088430Z","bundle_sha256":"5434690afca936dd4b039c58405f0123cf6e216abdd6275edbd3a8c669451e2b"}}