{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:RRHULU2AEOBVKVVNCQSAXSLR6F","short_pith_number":"pith:RRHULU2A","canonical_record":{"source":{"id":"2504.17198","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-24T02:15:45Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"32326fc47b8f6a26f6d4f63618551d5ae49874fc9f355b4b04e642e488ea5a5e","abstract_canon_sha256":"743ac2d23946b35d2d5308fdb077b381879a5c63c1871e4c38e196839bdd10a2"},"schema_version":"1.0"},"canonical_sha256":"8c4f45d34023835556ad14240bc971f14631c5c67ff264ec5e1a2cb129c55f4f","source":{"kind":"arxiv","id":"2504.17198","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.17198","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"arxiv_version","alias_value":"2504.17198v1","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.17198","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_12","alias_value":"RRHULU2AEOBV","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_16","alias_value":"RRHULU2AEOBVKVVN","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_8","alias_value":"RRHULU2A","created_at":"2026-07-05T10:53:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:RRHULU2AEOBVKVVNCQSAXSLR6F","target":"record","payload":{"canonical_record":{"source":{"id":"2504.17198","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-24T02:15:45Z","cross_cats_sorted":["cs.AI","cs.CR"],"title_canon_sha256":"32326fc47b8f6a26f6d4f63618551d5ae49874fc9f355b4b04e642e488ea5a5e","abstract_canon_sha256":"743ac2d23946b35d2d5308fdb077b381879a5c63c1871e4c38e196839bdd10a2"},"schema_version":"1.0"},"canonical_sha256":"8c4f45d34023835556ad14240bc971f14631c5c67ff264ec5e1a2cb129c55f4f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:53:24.047486Z","signature_b64":"iuIKI4g56tLPqnsp3TwqbqY01bVW8rpyQNOnPJxscekCj3ePds6M9EY/XFE5YK34exap6XVRyZfHEgunZZKeDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"8c4f45d34023835556ad14240bc971f14631c5c67ff264ec5e1a2cb129c55f4f","last_reissued_at":"2026-07-05T10:53:24.047072Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:53:24.047072Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2504.17198","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:53:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8xiWB25imQkhP4QvHIdZ8BZmtFefUSOa9HRwqKLyeY9mv0+qMmSFbuMW8GcuPFB7eDSB103uqC8WW4WLjvhNCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T04:58:16.943874Z"},"content_sha256":"132d3270467be41ccbb669aab7c0655af97d76d492bd5fd33fc162a56dd2d2dc","schema_version":"1.0","event_id":"sha256:132d3270467be41ccbb669aab7c0655af97d76d492bd5fd33fc162a56dd2d2dc"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:RRHULU2AEOBVKVVNCQSAXSLR6F","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Automatically Generating Rules of Malicious Software Packages via Large Language Model","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.CR"],"primary_cat":"cs.SE","authors_text":"Haoyu Chen, Qiang Li, Wenjia Niu, XiangRui Zhang, YongZhong He","submitted_at":"2025-04-24T02:15:45Z","abstract_excerpt":"Today's security tools predominantly rely on predefined rules crafted by experts, making them poorly adapted to the emergence of software supply chain attacks. To tackle this limitation, we propose a novel tool, RuleLLM, which leverages large language models (LLMs) to automate rule generation for OSS ecosystems. RuleLLM extracts metadata and code snippets from malware as its input, producing YARA and Semgrep rules that can be directly deployed in software development. Specifically, the rule generation task involves three subtasks: crafting rules, refining rules, and aligning rules. To validate"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.17198","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.17198/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:53:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"EojWzyRIvNPIOvhz9nQHoc2x1MHIPmXi0ArqewQkr8hFJuPPeFqP3Jdr/Nzs2Nilg/zXotCDjfwQOGAvAYpzCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T04:58:16.944826Z"},"content_sha256":"c6d75b5d446018d6b0599cd0319c2516d2d29febe508c6a29a5e80512080eb32","schema_version":"1.0","event_id":"sha256:c6d75b5d446018d6b0599cd0319c2516d2d29febe508c6a29a5e80512080eb32"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/bundle.json","state_url":"https://pith.science/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T04:58:16Z","links":{"resolver":"https://pith.science/pith/RRHULU2AEOBVKVVNCQSAXSLR6F","bundle":"https://pith.science/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/bundle.json","state":"https://pith.science/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/state.json","well_known_bundle":"https://pith.science/.well-known/pith/RRHULU2AEOBVKVVNCQSAXSLR6F/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:RRHULU2AEOBVKVVNCQSAXSLR6F","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"743ac2d23946b35d2d5308fdb077b381879a5c63c1871e4c38e196839bdd10a2","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-24T02:15:45Z","title_canon_sha256":"32326fc47b8f6a26f6d4f63618551d5ae49874fc9f355b4b04e642e488ea5a5e"},"schema_version":"1.0","source":{"id":"2504.17198","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.17198","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"arxiv_version","alias_value":"2504.17198v1","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.17198","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_12","alias_value":"RRHULU2AEOBV","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_16","alias_value":"RRHULU2AEOBVKVVN","created_at":"2026-07-05T10:53:24Z"},{"alias_kind":"pith_short_8","alias_value":"RRHULU2A","created_at":"2026-07-05T10:53:24Z"}],"graph_snapshots":[{"event_id":"sha256:c6d75b5d446018d6b0599cd0319c2516d2d29febe508c6a29a5e80512080eb32","target":"graph","created_at":"2026-07-05T10:53:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.17198/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Today's security tools predominantly rely on predefined rules crafted by experts, making them poorly adapted to the emergence of software supply chain attacks. To tackle this limitation, we propose a novel tool, RuleLLM, which leverages large language models (LLMs) to automate rule generation for OSS ecosystems. RuleLLM extracts metadata and code snippets from malware as its input, producing YARA and Semgrep rules that can be directly deployed in software development. Specifically, the rule generation task involves three subtasks: crafting rules, refining rules, and aligning rules. To validate","authors_text":"Haoyu Chen, Qiang Li, Wenjia Niu, XiangRui Zhang, YongZhong He","cross_cats":["cs.AI","cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-24T02:15:45Z","title":"Automatically Generating Rules of Malicious Software Packages via Large Language Model"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.17198","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:132d3270467be41ccbb669aab7c0655af97d76d492bd5fd33fc162a56dd2d2dc","target":"record","created_at":"2026-07-05T10:53:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"743ac2d23946b35d2d5308fdb077b381879a5c63c1871e4c38e196839bdd10a2","cross_cats_sorted":["cs.AI","cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-24T02:15:45Z","title_canon_sha256":"32326fc47b8f6a26f6d4f63618551d5ae49874fc9f355b4b04e642e488ea5a5e"},"schema_version":"1.0","source":{"id":"2504.17198","kind":"arxiv","version":1}},"canonical_sha256":"8c4f45d34023835556ad14240bc971f14631c5c67ff264ec5e1a2cb129c55f4f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"8c4f45d34023835556ad14240bc971f14631c5c67ff264ec5e1a2cb129c55f4f","first_computed_at":"2026-07-05T10:53:24.047072Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:53:24.047072Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"iuIKI4g56tLPqnsp3TwqbqY01bVW8rpyQNOnPJxscekCj3ePds6M9EY/XFE5YK34exap6XVRyZfHEgunZZKeDg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:53:24.047486Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.17198","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:132d3270467be41ccbb669aab7c0655af97d76d492bd5fd33fc162a56dd2d2dc","sha256:c6d75b5d446018d6b0599cd0319c2516d2d29febe508c6a29a5e80512080eb32"],"state_sha256":"b777a99b96301acbad846e396bad224b6d9e99cdaf6097791805a801f572ce6f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"n3n3a6YxeUHYT4F5ymVInrf4tOzkpFxMx+936z9Nlur6/6/9g7JKR+CXVbsiPsuhq23cJ1q+3k62cCLBN7wcDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T04:58:17.000562Z","bundle_sha256":"84cd3a896112773d06826db139d057751f03fa47e9f857dd245adbe501a84824"}}