{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:QRODETYAVHHWBXMU7BHSMUEI54","short_pith_number":"pith:QRODETYA","canonical_record":{"source":{"id":"2607.03350","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T14:05:54Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cd7343d1d1725bc21acae95c5223d1bfa846385cbf6a5f28dbbb00a443b32638","abstract_canon_sha256":"f05b5429ae4572a2fafea71580a68d538495a67f7f35f5a3ae06a9d70011b15c"},"schema_version":"1.0"},"canonical_sha256":"845c324f00a9cf60dd94f84f265088ef01e05c67f86a054709288fd05098c5a9","source":{"kind":"arxiv","id":"2607.03350","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.03350","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"arxiv_version","alias_value":"2607.03350v1","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.03350","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_12","alias_value":"QRODETYAVHHW","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_16","alias_value":"QRODETYAVHHWBXMU","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_8","alias_value":"QRODETYA","created_at":"2026-07-07T02:17:38Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:QRODETYAVHHWBXMU7BHSMUEI54","target":"record","payload":{"canonical_record":{"source":{"id":"2607.03350","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T14:05:54Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cd7343d1d1725bc21acae95c5223d1bfa846385cbf6a5f28dbbb00a443b32638","abstract_canon_sha256":"f05b5429ae4572a2fafea71580a68d538495a67f7f35f5a3ae06a9d70011b15c"},"schema_version":"1.0"},"canonical_sha256":"845c324f00a9cf60dd94f84f265088ef01e05c67f86a054709288fd05098c5a9","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-07T02:17:38.656511Z","signature_b64":"Glw/Glra6POjfvaJ3+MzT8b96dE74u/z8lMeXU3U6R/tEfAEAliry0omtkzoMqgfAUHF6IF2X9gp7qloeefmAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"845c324f00a9cf60dd94f84f265088ef01e05c67f86a054709288fd05098c5a9","last_reissued_at":"2026-07-07T02:17:38.655730Z","signature_status":"signed_v1","first_computed_at":"2026-07-07T02:17:38.655730Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.03350","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T02:17:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7e0Nf5+PV4CAl/20idGr3DwRyx08Qo8AwnHKTO1BvxNuYMOv5bul8Lm9CUvXYMqLFafBsExdgjyh5cRfIj/KDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-26T06:25:08.584044Z"},"content_sha256":"b80720eb8f1f59688c02cbc4ddfc9f832768896205b8cc7636ab7eefbcb02848","schema_version":"1.0","event_id":"sha256:b80720eb8f1f59688c02cbc4ddfc9f832768896205b8cc7636ab7eefbcb02848"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:QRODETYAVHHWBXMU7BHSMUEI54","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.SE"],"primary_cat":"cs.CR","authors_text":"Baoquan Cui, Fengge Wu, Hang Gao, Jian Zhang, Peng Qiao, Xiaoyu Chen, Zhen Tang","submitted_at":"2026-07-03T14:05:54Z","abstract_excerpt":"Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI. Existing learning-based detection methods struggle to capture the hierarchical organization and heterogeneous interactions among different program entities. Although Large Language Models (LLMs) have demonstrated strong capabilities in code understanding and semantic reasoning, they are rarely integrated with structural program representations for fine-grained malicious behavior analysis. In this paper, we propose an LLM-enhanced hier"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.03350","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.03350/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T02:17:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"M4jmNXnNd/eOSRMCi87ppwqtQUNE6rbkC8n//VelEbs8tLsG6eE+RzeqoKkzwOjczeJiCH6I2YkEDAgh6XtYAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-26T06:25:08.584441Z"},"content_sha256":"e09f723baa25ebfbb2d4b19e5f7d5024366e43113c2c97c456c27ae5a43ea0ee","schema_version":"1.0","event_id":"sha256:e09f723baa25ebfbb2d4b19e5f7d5024366e43113c2c97c456c27ae5a43ea0ee"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QRODETYAVHHWBXMU7BHSMUEI54/bundle.json","state_url":"https://pith.science/pith/QRODETYAVHHWBXMU7BHSMUEI54/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QRODETYAVHHWBXMU7BHSMUEI54/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-26T06:25:08Z","links":{"resolver":"https://pith.science/pith/QRODETYAVHHWBXMU7BHSMUEI54","bundle":"https://pith.science/pith/QRODETYAVHHWBXMU7BHSMUEI54/bundle.json","state":"https://pith.science/pith/QRODETYAVHHWBXMU7BHSMUEI54/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QRODETYAVHHWBXMU7BHSMUEI54/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:QRODETYAVHHWBXMU7BHSMUEI54","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f05b5429ae4572a2fafea71580a68d538495a67f7f35f5a3ae06a9d70011b15c","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T14:05:54Z","title_canon_sha256":"cd7343d1d1725bc21acae95c5223d1bfa846385cbf6a5f28dbbb00a443b32638"},"schema_version":"1.0","source":{"id":"2607.03350","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.03350","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"arxiv_version","alias_value":"2607.03350v1","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.03350","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_12","alias_value":"QRODETYAVHHW","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_16","alias_value":"QRODETYAVHHWBXMU","created_at":"2026-07-07T02:17:38Z"},{"alias_kind":"pith_short_8","alias_value":"QRODETYA","created_at":"2026-07-07T02:17:38Z"}],"graph_snapshots":[{"event_id":"sha256:e09f723baa25ebfbb2d4b19e5f7d5024366e43113c2c97c456c27ae5a43ea0ee","target":"graph","created_at":"2026-07-07T02:17:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.03350/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI. Existing learning-based detection methods struggle to capture the hierarchical organization and heterogeneous interactions among different program entities. Although Large Language Models (LLMs) have demonstrated strong capabilities in code understanding and semantic reasoning, they are rarely integrated with structural program representations for fine-grained malicious behavior analysis. In this paper, we propose an LLM-enhanced hier","authors_text":"Baoquan Cui, Fengge Wu, Hang Gao, Jian Zhang, Peng Qiao, Xiaoyu Chen, Zhen Tang","cross_cats":["cs.AI","cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T14:05:54Z","title":"LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.03350","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b80720eb8f1f59688c02cbc4ddfc9f832768896205b8cc7636ab7eefbcb02848","target":"record","created_at":"2026-07-07T02:17:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f05b5429ae4572a2fafea71580a68d538495a67f7f35f5a3ae06a9d70011b15c","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T14:05:54Z","title_canon_sha256":"cd7343d1d1725bc21acae95c5223d1bfa846385cbf6a5f28dbbb00a443b32638"},"schema_version":"1.0","source":{"id":"2607.03350","kind":"arxiv","version":1}},"canonical_sha256":"845c324f00a9cf60dd94f84f265088ef01e05c67f86a054709288fd05098c5a9","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"845c324f00a9cf60dd94f84f265088ef01e05c67f86a054709288fd05098c5a9","first_computed_at":"2026-07-07T02:17:38.655730Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-07T02:17:38.655730Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Glw/Glra6POjfvaJ3+MzT8b96dE74u/z8lMeXU3U6R/tEfAEAliry0omtkzoMqgfAUHF6IF2X9gp7qloeefmAw==","signature_status":"signed_v1","signed_at":"2026-07-07T02:17:38.656511Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.03350","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b80720eb8f1f59688c02cbc4ddfc9f832768896205b8cc7636ab7eefbcb02848","sha256:e09f723baa25ebfbb2d4b19e5f7d5024366e43113c2c97c456c27ae5a43ea0ee"],"state_sha256":"d7220abb1401ce46c067d22581e7ea8812419e2aaf081c3fb75b1d390d063c9b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SYddbTJpWEyVey6Gg/P0jQ+cMAF8uGxo26q+Tosgv3tYA+m6gJId2Sgpqc5/zw2eyU/FpMw3ds5rGu5v7xYPCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-26T06:25:08.587017Z","bundle_sha256":"b3cb95c3a17e17dafb487ae0d55d1322fe06d0efa86fe374a5b1e51c0b77c678"}}