{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:QXIRLM4EPVRULP3M2LH3PAAJQ4","short_pith_number":"pith:QXIRLM4E","canonical_record":{"source":{"id":"2412.05259","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-12-06T18:49:06Z","cross_cats_sorted":[],"title_canon_sha256":"7a7bb56fabcca6000cc58b389324cc298d473c1abbd7510bd24f8fbb17ce9d23","abstract_canon_sha256":"625b4e1c905676dad66a62b7938b264726df03a605a5f1474a7762326730816a"},"schema_version":"1.0"},"canonical_sha256":"85d115b3847d6345bf6cd2cfb78009872e5e75d0464cde9b359d38e05029bb27","source":{"kind":"arxiv","id":"2412.05259","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.05259","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"arxiv_version","alias_value":"2412.05259v1","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.05259","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_12","alias_value":"QXIRLM4EPVRU","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_16","alias_value":"QXIRLM4EPVRULP3M","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_8","alias_value":"QXIRLM4E","created_at":"2026-07-05T09:45:35Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:QXIRLM4EPVRULP3M2LH3PAAJQ4","target":"record","payload":{"canonical_record":{"source":{"id":"2412.05259","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-12-06T18:49:06Z","cross_cats_sorted":[],"title_canon_sha256":"7a7bb56fabcca6000cc58b389324cc298d473c1abbd7510bd24f8fbb17ce9d23","abstract_canon_sha256":"625b4e1c905676dad66a62b7938b264726df03a605a5f1474a7762326730816a"},"schema_version":"1.0"},"canonical_sha256":"85d115b3847d6345bf6cd2cfb78009872e5e75d0464cde9b359d38e05029bb27","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:45:35.472548Z","signature_b64":"EmOd3mhKc5TsW0PGctRNBys7xXkQEpQVnFr1GJ8CLnKGBirEaleoUcvlpYbZ3jf0Wyq84/s1Xos9C2NyAnv9AQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"85d115b3847d6345bf6cd2cfb78009872e5e75d0464cde9b359d38e05029bb27","last_reissued_at":"2026-07-05T09:45:35.472039Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:45:35.472039Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2412.05259","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:45:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Jgj9e+KUKU590d+fD4OkFrfLW3rSTuwOWROb+kP3w1htq5zlOot8pA/ykG830kW3499nbYhU71cHtLqH2RS7BA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T22:40:20.336147Z"},"content_sha256":"ff905f223db128ba9f61bf01fb2648b0b7203873c9f405196cc9a4ebe28f501a","schema_version":"1.0","event_id":"sha256:ff905f223db128ba9f61bf01fb2648b0b7203873c9f405196cc9a4ebe28f501a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:QXIRLM4EPVRULP3M2LH3PAAJQ4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Machine Learning-Based Approach For Detecting Malicious PyPI Packages","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"(2) Concordia University, (3) University of Calgary, Ahmad Abdellatif (3) ((1) An Najah National University, Alberta, Calgary, Canada, Canada), Diego Elias Costa (2), Emad Shihab (2), Haya Samaana (1), Montreal, Nablus, Palestine, Quebec","submitted_at":"2024-12-06T18:49:06Z","abstract_excerpt":"Background. In modern software development, the use of external libraries and packages is increasingly prevalent, streamlining the software development process and enabling developers to deploy feature-rich systems with little coding. While this reliance on reusing code offers substantial benefits, it also introduces serious risks for deployed software in the form of malicious packages - harmful and vulnerable code disguised as useful libraries. Aims. Popular ecosystems, such PyPI, receive thousands of new package contributions every week, and distinguishing safe contributions from harmful one"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.05259","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2412.05259/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:45:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eizCPsMn86qHxpTVvEU1akp0pmAhMwE/j8BM+h1KeJRS7ReyCMO10VAKBEbnUxw5hbSF1300snYsWxkYDGpqDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T22:40:20.336537Z"},"content_sha256":"f45fe31511824cbab5420878d21885d4e40c4bf28c5592b2dffabc21f19a6116","schema_version":"1.0","event_id":"sha256:f45fe31511824cbab5420878d21885d4e40c4bf28c5592b2dffabc21f19a6116"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/bundle.json","state_url":"https://pith.science/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-13T22:40:20Z","links":{"resolver":"https://pith.science/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4","bundle":"https://pith.science/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/bundle.json","state":"https://pith.science/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QXIRLM4EPVRULP3M2LH3PAAJQ4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:QXIRLM4EPVRULP3M2LH3PAAJQ4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"625b4e1c905676dad66a62b7938b264726df03a605a5f1474a7762326730816a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-12-06T18:49:06Z","title_canon_sha256":"7a7bb56fabcca6000cc58b389324cc298d473c1abbd7510bd24f8fbb17ce9d23"},"schema_version":"1.0","source":{"id":"2412.05259","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.05259","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"arxiv_version","alias_value":"2412.05259v1","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.05259","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_12","alias_value":"QXIRLM4EPVRU","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_16","alias_value":"QXIRLM4EPVRULP3M","created_at":"2026-07-05T09:45:35Z"},{"alias_kind":"pith_short_8","alias_value":"QXIRLM4E","created_at":"2026-07-05T09:45:35Z"}],"graph_snapshots":[{"event_id":"sha256:f45fe31511824cbab5420878d21885d4e40c4bf28c5592b2dffabc21f19a6116","target":"graph","created_at":"2026-07-05T09:45:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2412.05259/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Background. In modern software development, the use of external libraries and packages is increasingly prevalent, streamlining the software development process and enabling developers to deploy feature-rich systems with little coding. While this reliance on reusing code offers substantial benefits, it also introduces serious risks for deployed software in the form of malicious packages - harmful and vulnerable code disguised as useful libraries. Aims. Popular ecosystems, such PyPI, receive thousands of new package contributions every week, and distinguishing safe contributions from harmful one","authors_text":"(2) Concordia University, (3) University of Calgary, Ahmad Abdellatif (3) ((1) An Najah National University, Alberta, Calgary, Canada, Canada), Diego Elias Costa (2), Emad Shihab (2), Haya Samaana (1), Montreal, Nablus, Palestine, Quebec","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-12-06T18:49:06Z","title":"A Machine Learning-Based Approach For Detecting Malicious PyPI Packages"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.05259","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ff905f223db128ba9f61bf01fb2648b0b7203873c9f405196cc9a4ebe28f501a","target":"record","created_at":"2026-07-05T09:45:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"625b4e1c905676dad66a62b7938b264726df03a605a5f1474a7762326730816a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2024-12-06T18:49:06Z","title_canon_sha256":"7a7bb56fabcca6000cc58b389324cc298d473c1abbd7510bd24f8fbb17ce9d23"},"schema_version":"1.0","source":{"id":"2412.05259","kind":"arxiv","version":1}},"canonical_sha256":"85d115b3847d6345bf6cd2cfb78009872e5e75d0464cde9b359d38e05029bb27","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"85d115b3847d6345bf6cd2cfb78009872e5e75d0464cde9b359d38e05029bb27","first_computed_at":"2026-07-05T09:45:35.472039Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:45:35.472039Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"EmOd3mhKc5TsW0PGctRNBys7xXkQEpQVnFr1GJ8CLnKGBirEaleoUcvlpYbZ3jf0Wyq84/s1Xos9C2NyAnv9AQ==","signature_status":"signed_v1","signed_at":"2026-07-05T09:45:35.472548Z","signed_message":"canonical_sha256_bytes"},"source_id":"2412.05259","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ff905f223db128ba9f61bf01fb2648b0b7203873c9f405196cc9a4ebe28f501a","sha256:f45fe31511824cbab5420878d21885d4e40c4bf28c5592b2dffabc21f19a6116"],"state_sha256":"be9696a3433f65376fb3047b5f88ae1b66f28a422f6a0160fe546dbe102360c3"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0yphPU/1HS0SYV+ZZ+GAkhcv6ii89SUnLQ7vxW/FoyhbVkIdu6Tj6/jCefYE8bwcZOfh100FBVxlRDCyt4TaBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-13T22:40:20.344752Z","bundle_sha256":"53e21f388b9934227ab734a1246ae68d0c85546f88558f923aa65c8f19d69c58"}}