Pith Number

pith:W25SJX3L

pith:2020:W25SJX3L6NZATL2HQDXLBCGFLO

not attested not anchored not stored refs pending

Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages

Brendan Saltaformaggio, Omar Alrawi, Ranjita Pai Kasturi, Ruian Duan, Ryan Elder, Wenke Lee

arxiv:2002.01139 v2 · 2020-02-04 · cs.CR

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{W25SJX3L6NZATL2HQDXLBCGFLO}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Cited by

3 papers in Pith

Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks

A First Look at the Security Issues in the Model Context Protocol Ecosystem

Do Skill Descriptions Tell the Truth? Detecting Undisclosed Security Behaviors in Code-Backed LLM Skills

Receipt and verification

First computed	2026-07-05T01:56:28.977214Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289

Aliases

arxiv: 2002.01139 · arxiv_version: 2002.01139v2 · doi: 10.48550/arxiv.2002.01139 · pith_short_12: W25SJX3L6NZA · pith_short_16: W25SJX3L6NZATL2H · pith_short_8: W25SJX3L

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "959d3813c77d9e022c433ab97a0174a2b459770d12d8d467335c6db72ab3c9e9",
    "cross_cats_sorted": [],
    "license": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2020-02-04T06:10:18Z",
    "title_canon_sha256": "7f05be8fe6a1898d839058397d59f05d8fcffad9042325bd6a4fcc3db83e77fa"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2002.01139",
    "kind": "arxiv",
    "version": 2
  }
}