{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:P3SDFQAJJCJEDO2VX5WLL7RWSV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"5d898570f418a08b4237aeda64e36095534d929d95c200e5cb34ac85f127e1fb","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2020-03-06T23:59:48Z","title_canon_sha256":"3a8f6fa964d0e08cf23733d20730708fc64aa8272273825fedf1b65814afaffa"},"schema_version":"1.0","source":{"id":"2003.03471","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2003.03471","created_at":"2026-07-05T00:46:21Z"},{"alias_kind":"arxiv_version","alias_value":"2003.03471v1","created_at":"2026-07-05T00:46:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2003.03471","created_at":"2026-07-05T00:46:21Z"},{"alias_kind":"pith_short_12","alias_value":"P3SDFQAJJCJE","created_at":"2026-07-05T00:46:21Z"},{"alias_kind":"pith_short_16","alias_value":"P3SDFQAJJCJEDO2V","created_at":"2026-07-05T00:46:21Z"},{"alias_kind":"pith_short_8","alias_value":"P3SDFQAJ","created_at":"2026-07-05T00:46:21Z"}],"graph_snapshots":[{"event_id":"sha256:3660a5d063b711bfcad9f910bc04d4799dab673edfcc330e10cc80ae281859a8","target":"graph","created_at":"2026-07-05T00:46:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2003.03471/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Package managers for software repositories based on a single programming language are very common. Examples include npm (JavaScript), and PyPI (Python). These tools encourage code reuse, making it trivial for developers to import external packages. Unfortunately, repositories' size and the ease with which packages can be published facilitates the practice of typosquatting: the uploading of a package with name similar to that of a highly popular package, typically with the aim of capturing some of the popular package's installs. Typosquatting has serious negative implications, resulting in deve","authors_text":"Drew Davidson, Lorenzo De Carli, Matthew Taylor, Ruturaj K. Vaidya, Vaibhav Rastogi","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2020-03-06T23:59:48Z","title":"SpellBound: Defending Against Package Typosquatting"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2003.03471","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a4e473542cc885dcbcc07236fa9110cf58953a0933da415570596deacbe192a0","target":"record","created_at":"2026-07-05T00:46:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"5d898570f418a08b4237aeda64e36095534d929d95c200e5cb34ac85f127e1fb","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2020-03-06T23:59:48Z","title_canon_sha256":"3a8f6fa964d0e08cf23733d20730708fc64aa8272273825fedf1b65814afaffa"},"schema_version":"1.0","source":{"id":"2003.03471","kind":"arxiv","version":1}},"canonical_sha256":"7ee432c009489241bb55bf6cb5fe36955a81ac5750e9c5b6c47722830c2c3b18","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7ee432c009489241bb55bf6cb5fe36955a81ac5750e9c5b6c47722830c2c3b18","first_computed_at":"2026-07-05T00:46:21.734243Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T00:46:21.734243Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"4th2bVluIRYYtoQv0Gm8ksq5aXzyw94MfifRsCY4OGS1xs8A+mPYt4AloPTF38t2Kbod/xuiFKUWOKUamFt4Bw==","signature_status":"signed_v1","signed_at":"2026-07-05T00:46:21.734697Z","signed_message":"canonical_sha256_bytes"},"source_id":"2003.03471","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a4e473542cc885dcbcc07236fa9110cf58953a0933da415570596deacbe192a0","sha256:3660a5d063b711bfcad9f910bc04d4799dab673edfcc330e10cc80ae281859a8"],"state_sha256":"2ea7f2d1d2379221e7cd103667e9ea225f66f84824d8156463f8f0c3c991af51"}