{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:QCUCRPHEDVJTG5XGCPFNLWKR7H","short_pith_number":"pith:QCUCRPHE","canonical_record":{"source":{"id":"2402.13375","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","cross_cats_sorted":[],"title_canon_sha256":"4f549d22086f955984d1d42e4f7076450bb0ffc32da1e77b202b990dfbe9cda0","abstract_canon_sha256":"37165c65c6a8531fe24738130d0e9ad1665c501f27a8e1fce197989fab1a6d3c"},"schema_version":"1.0"},"canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","source":{"kind":"arxiv","id":"2402.13375","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.13375","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"arxiv_version","alias_value":"2402.13375v3","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.13375","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_12","alias_value":"QCUCRPHEDVJT","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_16","alias_value":"QCUCRPHEDVJTG5XG","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_8","alias_value":"QCUCRPHE","created_at":"2026-07-05T11:29:47Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:QCUCRPHEDVJTG5XGCPFNLWKR7H","target":"record","payload":{"canonical_record":{"source":{"id":"2402.13375","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","cross_cats_sorted":[],"title_canon_sha256":"4f549d22086f955984d1d42e4f7076450bb0ffc32da1e77b202b990dfbe9cda0","abstract_canon_sha256":"37165c65c6a8531fe24738130d0e9ad1665c501f27a8e1fce197989fab1a6d3c"},"schema_version":"1.0"},"canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:29:47.585148Z","signature_b64":"Pn7iEqsoXkMBhGnAYJ3eQ2na24IWYEYfJDstiBCyivamOUNVEGHGL915lC6RTPAAGNkMOA6jMvlCLCu7SgN2Bw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","last_reissued_at":"2026-07-05T11:29:47.584716Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:29:47.584716Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2402.13375","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:29:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1osgAlOk3nMlEBnVjFvCA7XkUQ1a464yZ85hU8kWSg+8j8ikEg74RrV2h9oTeywKT1lm5JnFze/wNJAxhnR6BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T07:08:09.296507Z"},"content_sha256":"0bd930b0cf9632a5918cd79ff17a549c9d129f20a16bf4a5c77f3f8ab295c935","schema_version":"1.0","event_id":"sha256:0bd930b0cf9632a5918cd79ff17a549c9d129f20a16bf4a5c77f3f8ab295c935"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:QCUCRPHEDVJTG5XGCPFNLWKR7H","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Vulnerability Webs: Systemic Risk in Software Networks","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"econ.EM","authors_text":"Angelo Mele, Co-Pierre Georg, Cornelius Fritz, Michael Schweinberger","submitted_at":"2024-02-20T20:59:20Z","abstract_excerpt":"Software development relies on code reuse to minimize costs, creating vulnerability risks through dependencies with substantial economic impact, as seen in the Crowdstrike and HeartBleed incidents. We analyze 52,897 dependencies across 16,102 Python repositories using a strategic network formation model incorporating observable and unobservable heterogeneity. Through variational approximation of conditional distributions, we demonstrate that dependency creation generates negative externalities. Vulnerability propagation, modeled as a contagion process, shows that popular protection heuristics "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.13375","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2402.13375/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:29:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gxXxDn8x8qL/Cr2i6eLMXqZTnhx2q9FvZi4yo8Uq1vd40r91DXPR3w4wSrlpbdgunnjgIgobgKqXY/RMhfbGAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T07:08:09.297081Z"},"content_sha256":"b9db2954ce7554f949f21eedd1a1f609430ad1e5ce01e9136b6be00803d879d6","schema_version":"1.0","event_id":"sha256:b9db2954ce7554f949f21eedd1a1f609430ad1e5ce01e9136b6be00803d879d6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/bundle.json","state_url":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T07:08:09Z","links":{"resolver":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H","bundle":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/bundle.json","state":"https://pith.science/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QCUCRPHEDVJTG5XGCPFNLWKR7H/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:QCUCRPHEDVJTG5XGCPFNLWKR7H","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"37165c65c6a8531fe24738130d0e9ad1665c501f27a8e1fce197989fab1a6d3c","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","title_canon_sha256":"4f549d22086f955984d1d42e4f7076450bb0ffc32da1e77b202b990dfbe9cda0"},"schema_version":"1.0","source":{"id":"2402.13375","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.13375","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"arxiv_version","alias_value":"2402.13375v3","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.13375","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_12","alias_value":"QCUCRPHEDVJT","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_16","alias_value":"QCUCRPHEDVJTG5XG","created_at":"2026-07-05T11:29:47Z"},{"alias_kind":"pith_short_8","alias_value":"QCUCRPHE","created_at":"2026-07-05T11:29:47Z"}],"graph_snapshots":[{"event_id":"sha256:b9db2954ce7554f949f21eedd1a1f609430ad1e5ce01e9136b6be00803d879d6","target":"graph","created_at":"2026-07-05T11:29:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2402.13375/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software development relies on code reuse to minimize costs, creating vulnerability risks through dependencies with substantial economic impact, as seen in the Crowdstrike and HeartBleed incidents. We analyze 52,897 dependencies across 16,102 Python repositories using a strategic network formation model incorporating observable and unobservable heterogeneity. Through variational approximation of conditional distributions, we demonstrate that dependency creation generates negative externalities. Vulnerability propagation, modeled as a contagion process, shows that popular protection heuristics ","authors_text":"Angelo Mele, Co-Pierre Georg, Cornelius Fritz, Michael Schweinberger","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","title":"Vulnerability Webs: Systemic Risk in Software Networks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.13375","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0bd930b0cf9632a5918cd79ff17a549c9d129f20a16bf4a5c77f3f8ab295c935","target":"record","created_at":"2026-07-05T11:29:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"37165c65c6a8531fe24738130d0e9ad1665c501f27a8e1fce197989fab1a6d3c","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"econ.EM","submitted_at":"2024-02-20T20:59:20Z","title_canon_sha256":"4f549d22086f955984d1d42e4f7076450bb0ffc32da1e77b202b990dfbe9cda0"},"schema_version":"1.0","source":{"id":"2402.13375","kind":"arxiv","version":3}},"canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"80a828bce41d533376e613cad5d951f9c7a7d43936e427cd6c22f7d0f82e877b","first_computed_at":"2026-07-05T11:29:47.584716Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:29:47.584716Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Pn7iEqsoXkMBhGnAYJ3eQ2na24IWYEYfJDstiBCyivamOUNVEGHGL915lC6RTPAAGNkMOA6jMvlCLCu7SgN2Bw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:29:47.585148Z","signed_message":"canonical_sha256_bytes"},"source_id":"2402.13375","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0bd930b0cf9632a5918cd79ff17a549c9d129f20a16bf4a5c77f3f8ab295c935","sha256:b9db2954ce7554f949f21eedd1a1f609430ad1e5ce01e9136b6be00803d879d6"],"state_sha256":"cb443be6ca2a9cd7aefbc945cfc0b0974d8fa1bff6ae0c0931031a88fffc1123"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9MDWn/rDPB8X8MpsmCdKNOlRsVBEuuGTw6DLXnInbcdI8gSh2pxUsSIglsywq8NMUhjd1RvBXPW96a75LISlAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T07:08:09.301898Z","bundle_sha256":"334979da6fc0f4653b6e094cb1da983860496ea1061b69893531144559c2e5a0"}}