{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:VXROSLL7YBYWKLYKKLH46KHDAZ","short_pith_number":"pith:VXROSLL7","canonical_record":{"source":{"id":"2404.04991","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-04-07T15:25:13Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"4cd6194d1837a331ff6d894333e26a5a80158eb5889067460fa0389cca87ff98","abstract_canon_sha256":"6d82411286ef796e4ef968ba72232338d3ecefbb5656b11713cb83329c809013"},"schema_version":"1.0"},"canonical_sha256":"ade2e92d7fc071652f0a52cfcf28e3066dd30444540ae5d838607637387422a1","source":{"kind":"arxiv","id":"2404.04991","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2404.04991","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"arxiv_version","alias_value":"2404.04991v3","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2404.04991","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_12","alias_value":"VXROSLL7YBYW","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_16","alias_value":"VXROSLL7YBYWKLYK","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_8","alias_value":"VXROSLL7","created_at":"2026-07-05T10:50:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:VXROSLL7YBYWKLYKKLH46KHDAZ","target":"record","payload":{"canonical_record":{"source":{"id":"2404.04991","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-04-07T15:25:13Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"4cd6194d1837a331ff6d894333e26a5a80158eb5889067460fa0389cca87ff98","abstract_canon_sha256":"6d82411286ef796e4ef968ba72232338d3ecefbb5656b11713cb83329c809013"},"schema_version":"1.0"},"canonical_sha256":"ade2e92d7fc071652f0a52cfcf28e3066dd30444540ae5d838607637387422a1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:50:08.067600Z","signature_b64":"xkaoAtsiTiljvT4ksnmhKwcg+kS9WKNGAuElszuz9/pghDXefKUtnIUTT+ZKY/aSYCuhdfV2Qis+wr4L4R/+Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ade2e92d7fc071652f0a52cfcf28e3066dd30444540ae5d838607637387422a1","last_reissued_at":"2026-07-05T10:50:08.067177Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:50:08.067177Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2404.04991","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:50:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gCOdkiXpOBOb3TkvS3z5XUu+v1y2GZyQPeVvxsEi62VL1NGuuHwyQ69FZK6U42uenNhydyS5rEDF9cUndMDICQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T12:21:42.130228Z"},"content_sha256":"52438981543b1ede784378e93d593ff5f2185a990a48062b37ac62f0d048961d","schema_version":"1.0","event_id":"sha256:52438981543b1ede784378e93d593ff5f2185a990a48062b37ac62f0d048961d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:VXROSLL7YBYWKLYKKLH46KHDAZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Analysis of Malicious Packages in Open-Source Software in the Wild","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Haining Wang, Jiqiang Liu, Qiang Li, Wenjia Niu, Xiaoyan Zhou, Ying Zhang","submitted_at":"2024-04-07T15:25:13Z","abstract_excerpt":"The open-source software (OSS) ecosystem suffers from security threats caused by malware.However, OSS malware research has three limitations: a lack of high-quality datasets, a lack of malware diversity, and a lack of attack campaign contexts. In this paper, we first build the largest dataset of 24,356 malicious packages from online sources, then propose a knowledge graph to represent the OSS malware corpus and conduct malware analysis in the wild.Our main findings include (1) it is essential to collect malicious packages from various online sources because their data overlapping degrees are s"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2404.04991","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2404.04991/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:50:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AeyWmDvJey8VdgYlI+Ewbb0er42sovjxff/FNSeQfNO8MtWctQj8e4awggUat2jl89A8gZP8bUDf5CsqkwxDCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T12:21:42.130611Z"},"content_sha256":"4b03af07fb612dd98fb419c1e06ff75aa418f958bbb0bc993474a64e6d0aff61","schema_version":"1.0","event_id":"sha256:4b03af07fb612dd98fb419c1e06ff75aa418f958bbb0bc993474a64e6d0aff61"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/bundle.json","state_url":"https://pith.science/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T12:21:42Z","links":{"resolver":"https://pith.science/pith/VXROSLL7YBYWKLYKKLH46KHDAZ","bundle":"https://pith.science/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/bundle.json","state":"https://pith.science/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/VXROSLL7YBYWKLYKKLH46KHDAZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:VXROSLL7YBYWKLYKKLH46KHDAZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6d82411286ef796e4ef968ba72232338d3ecefbb5656b11713cb83329c809013","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-04-07T15:25:13Z","title_canon_sha256":"4cd6194d1837a331ff6d894333e26a5a80158eb5889067460fa0389cca87ff98"},"schema_version":"1.0","source":{"id":"2404.04991","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2404.04991","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"arxiv_version","alias_value":"2404.04991v3","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2404.04991","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_12","alias_value":"VXROSLL7YBYW","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_16","alias_value":"VXROSLL7YBYWKLYK","created_at":"2026-07-05T10:50:08Z"},{"alias_kind":"pith_short_8","alias_value":"VXROSLL7","created_at":"2026-07-05T10:50:08Z"}],"graph_snapshots":[{"event_id":"sha256:4b03af07fb612dd98fb419c1e06ff75aa418f958bbb0bc993474a64e6d0aff61","target":"graph","created_at":"2026-07-05T10:50:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2404.04991/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The open-source software (OSS) ecosystem suffers from security threats caused by malware.However, OSS malware research has three limitations: a lack of high-quality datasets, a lack of malware diversity, and a lack of attack campaign contexts. In this paper, we first build the largest dataset of 24,356 malicious packages from online sources, then propose a knowledge graph to represent the OSS malware corpus and conduct malware analysis in the wild.Our main findings include (1) it is essential to collect malicious packages from various online sources because their data overlapping degrees are s","authors_text":"Haining Wang, Jiqiang Liu, Qiang Li, Wenjia Niu, Xiaoyan Zhou, Ying Zhang","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-04-07T15:25:13Z","title":"An Analysis of Malicious Packages in Open-Source Software in the Wild"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2404.04991","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:52438981543b1ede784378e93d593ff5f2185a990a48062b37ac62f0d048961d","target":"record","created_at":"2026-07-05T10:50:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6d82411286ef796e4ef968ba72232338d3ecefbb5656b11713cb83329c809013","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-04-07T15:25:13Z","title_canon_sha256":"4cd6194d1837a331ff6d894333e26a5a80158eb5889067460fa0389cca87ff98"},"schema_version":"1.0","source":{"id":"2404.04991","kind":"arxiv","version":3}},"canonical_sha256":"ade2e92d7fc071652f0a52cfcf28e3066dd30444540ae5d838607637387422a1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ade2e92d7fc071652f0a52cfcf28e3066dd30444540ae5d838607637387422a1","first_computed_at":"2026-07-05T10:50:08.067177Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:50:08.067177Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"xkaoAtsiTiljvT4ksnmhKwcg+kS9WKNGAuElszuz9/pghDXefKUtnIUTT+ZKY/aSYCuhdfV2Qis+wr4L4R/+Dg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:50:08.067600Z","signed_message":"canonical_sha256_bytes"},"source_id":"2404.04991","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:52438981543b1ede784378e93d593ff5f2185a990a48062b37ac62f0d048961d","sha256:4b03af07fb612dd98fb419c1e06ff75aa418f958bbb0bc993474a64e6d0aff61"],"state_sha256":"6fc59641e0e875c4615da4a862dbbb79a65ef30a6894f25f8107f385609950eb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lt9RGghwNqkqlO6n1l+xEdjPZp8GcHk4ASm1EqOCtOOGcjp99XXrkq/b66ZUazXopVJu5p/2nry9uqXhAu/HBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T12:21:42.132559Z","bundle_sha256":"a303093c165b3eab87c8038b89127337aeb0fbf65de562e7b253dc17182f7fdc"}}