{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:QCUCRPHEDVJTG5XGCPFNLWKR7H","short_pith_number":"pith:QCUCRPHE","schema_version":"1.0","canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","source":{"kind":"arxiv","id":"2402.13375","version":3},"attestation_state":"computed","paper":{"title":"Vulnerability Webs: Systemic Risk in Software Networks","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"econ.EM","authors_text":"Angelo Mele, Co-Pierre Georg, Cornelius Fritz, Michael Schweinberger","submitted_at":"2024-02-20T20:59:20Z","abstract_excerpt":"Software development relies on code reuse to minimize costs, creating vulnerability risks through dependencies with substantial economic impact, as seen in the Crowdstrike and HeartBleed incidents. We analyze 52,897 dependencies across 16,102 Python repositories using a strategic network formation model incorporating observable and unobservable heterogeneity. Through variational approximation of conditional distributions, we demonstrate that dependency creation generates negative externalities. Vulnerability propagation, modeled as a contagion process, shows that popular protection heuristics "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2402.13375","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","cross_cats_sorted":[],"title_canon_sha256":"4f549d22086f955984d1d42e4f7076450bb0ffc32da1e77b202b990dfbe9cda0","abstract_canon_sha256":"37165c65c6a8531fe24738130d0e9ad1665c501f27a8e1fce197989fab1a6d3c"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:29:47.585148Z","signature_b64":"Pn7iEqsoXkMBhGnAYJ3eQ2na24IWYEYfJDstiBCyivamOUNVEGHGL915lC6RTPAAGNkMOA6jMvlCLCu7SgN2Bw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","last_reissued_at":"2026-07-05T11:29:47.584716Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:29:47.584716Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Vulnerability Webs: Systemic Risk in Software Networks","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"econ.EM","authors_text":"Angelo Mele, Co-Pierre Georg, Cornelius Fritz, Michael Schweinberger","submitted_at":"2024-02-20T20:59:20Z","abstract_excerpt":"Software development relies on code reuse to minimize costs, creating vulnerability risks through dependencies with substantial economic impact, as seen in the Crowdstrike and HeartBleed incidents. We analyze 52,897 dependencies across 16,102 Python repositories using a strategic network formation model incorporating observable and unobservable heterogeneity. Through variational approximation of conditional distributions, we demonstrate that dependency creation generates negative externalities. Vulnerability propagation, modeled as a contagion process, shows that popular protection heuristics "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.13375","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2402.13375/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2402.13375","created_at":"2026-07-05T11:29:47.584772+00:00"},{"alias_kind":"arxiv_version","alias_value":"2402.13375v3","created_at":"2026-07-05T11:29:47.584772+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.13375","created_at":"2026-07-05T11:29:47.584772+00:00"},{"alias_kind":"pith_short_12","alias_value":"QCUCRPHEDVJT","created_at":"2026-07-05T11:29:47.584772+00:00"},{"alias_kind":"pith_short_16","alias_value":"QCUCRPHEDVJTG5XG","created_at":"2026-07-05T11:29:47.584772+00:00"},{"alias_kind":"pith_short_8","alias_value":"QCUCRPHE","created_at":"2026-07-05T11:29:47.584772+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":2,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2605.06164","citing_title":"Modeling Dependency-Propagated Ecosystem Impact of Changes in Maintenance Activities: Evaluating Support Strategies in the PyPI Network","ref_index":8,"is_internal_anchor":false},{"citing_arxiv_id":"2605.06164","citing_title":"Modeling Dependency-Propagated Ecosystem Impact of Changes in Maintenance Activities: Evaluating Support Strategies in the PyPI Network","ref_index":8,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H","json":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H.json","graph_json":"https://pith.science/api/pith-number/QCUCRPHEDVJTG5XGCPFNLWKR7H/graph.json","events_json":"https://pith.science/api/pith-number/QCUCRPHEDVJTG5XGCPFNLWKR7H/events.json","paper":"https://pith.science/paper/QCUCRPHE"},"agent_actions":{"view_html":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H","download_json":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H.json","view_paper":"https://pith.science/paper/QCUCRPHE","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2402.13375&json=true","fetch_graph":"https://pith.science/api/pith-number/QCUCRPHEDVJTG5XGCPFNLWKR7H/graph.json","fetch_events":"https://pith.science/api/pith-number/QCUCRPHEDVJTG5XGCPFNLWKR7H/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/action/timestamp_anchor","attest_storage":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/action/storage_attestation","attest_author":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/action/author_attestation","sign_citation":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/action/citation_signature","submit_replication":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/action/replication_record"}},"created_at":"2026-07-05T11:29:47.584772+00:00","updated_at":"2026-07-05T11:29:47.584772+00:00"}