{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:W25SJX3L6NZATL2HQDXLBCGFLO","short_pith_number":"pith:W25SJX3L","canonical_record":{"source":{"id":"2002.01139","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-02-04T06:10:18Z","cross_cats_sorted":[],"title_canon_sha256":"7f05be8fe6a1898d839058397d59f05d8fcffad9042325bd6a4fcc3db83e77fa","abstract_canon_sha256":"959d3813c77d9e022c433ab97a0174a2b459770d12d8d467335c6db72ab3c9e9"},"schema_version":"1.0"},"canonical_sha256":"b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289","source":{"kind":"arxiv","id":"2002.01139","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2002.01139","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"arxiv_version","alias_value":"2002.01139v2","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2002.01139","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_12","alias_value":"W25SJX3L6NZA","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_16","alias_value":"W25SJX3L6NZATL2H","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_8","alias_value":"W25SJX3L","created_at":"2026-07-05T01:56:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:W25SJX3L6NZATL2HQDXLBCGFLO","target":"record","payload":{"canonical_record":{"source":{"id":"2002.01139","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-02-04T06:10:18Z","cross_cats_sorted":[],"title_canon_sha256":"7f05be8fe6a1898d839058397d59f05d8fcffad9042325bd6a4fcc3db83e77fa","abstract_canon_sha256":"959d3813c77d9e022c433ab97a0174a2b459770d12d8d467335c6db72ab3c9e9"},"schema_version":"1.0"},"canonical_sha256":"b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T01:56:28.977645Z","signature_b64":"oE/uqqzvc6kSPMhBLAEuhwa19yG0zQc2LlwCp8jGa4b1DZAK/N6P1PzE7nMyjfd8CBlc2zcvYRBGHTigjn5gAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289","last_reissued_at":"2026-07-05T01:56:28.977214Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T01:56:28.977214Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2002.01139","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:56:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iVvR86N4cL9ZUw6YRKHWN2dE4sUehavhktmzFnEffVGQJnmnwWDDz8wDsDL7ajDZkOqgu1qM+V1JrhoJ8u7+Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T22:50:02.507041Z"},"content_sha256":"5420dd082047d38f52cf434f9ed5e54f2129c8ac6e59157735e0591e6138d258","schema_version":"1.0","event_id":"sha256:5420dd082047d38f52cf434f9ed5e54f2129c8ac6e59157735e0591e6138d258"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:W25SJX3L6NZATL2HQDXLBCGFLO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Brendan Saltaformaggio, Omar Alrawi, Ranjita Pai Kasturi, Ruian Duan, Ryan Elder, Wenke Lee","submitted_at":"2020-02-04T06:10:18Z","abstract_excerpt":"Package managers have become a vital part of the modern software development process. They allow developers to reuse third-party code, share their own code, minimize their codebase, and simplify the build process. However, recent reports showed that package managers have been abused by attackers to distribute malware, posing significant security risks to developers and end-users. For example, eslint-scope, a package with millions of weekly downloads in Npm, was compromised to steal credentials from developers. To understand the security gaps and the misplaced trust that make recent supply chai"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2002.01139","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2002.01139/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:56:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PT9+hhTn9Ui7T1JuM16JG1W3kiSLCEbh9v8ywSHr2YsEgoBFGHjSR+vcqjPFvwlUyFybQetJk2xwgP25ita/Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T22:50:02.509590Z"},"content_sha256":"b2ff4d6eca2ef704c71dfa0a8106f310edf531b4b9a5182fbd0598c23cfe26b7","schema_version":"1.0","event_id":"sha256:b2ff4d6eca2ef704c71dfa0a8106f310edf531b4b9a5182fbd0598c23cfe26b7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO/bundle.json","state_url":"https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/W25SJX3L6NZATL2HQDXLBCGFLO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-13T22:50:02Z","links":{"resolver":"https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO","bundle":"https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO/bundle.json","state":"https://pith.science/pith/W25SJX3L6NZATL2HQDXLBCGFLO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/W25SJX3L6NZATL2HQDXLBCGFLO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:W25SJX3L6NZATL2HQDXLBCGFLO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"959d3813c77d9e022c433ab97a0174a2b459770d12d8d467335c6db72ab3c9e9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-02-04T06:10:18Z","title_canon_sha256":"7f05be8fe6a1898d839058397d59f05d8fcffad9042325bd6a4fcc3db83e77fa"},"schema_version":"1.0","source":{"id":"2002.01139","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2002.01139","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"arxiv_version","alias_value":"2002.01139v2","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2002.01139","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_12","alias_value":"W25SJX3L6NZA","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_16","alias_value":"W25SJX3L6NZATL2H","created_at":"2026-07-05T01:56:28Z"},{"alias_kind":"pith_short_8","alias_value":"W25SJX3L","created_at":"2026-07-05T01:56:28Z"}],"graph_snapshots":[{"event_id":"sha256:b2ff4d6eca2ef704c71dfa0a8106f310edf531b4b9a5182fbd0598c23cfe26b7","target":"graph","created_at":"2026-07-05T01:56:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2002.01139/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Package managers have become a vital part of the modern software development process. They allow developers to reuse third-party code, share their own code, minimize their codebase, and simplify the build process. However, recent reports showed that package managers have been abused by attackers to distribute malware, posing significant security risks to developers and end-users. For example, eslint-scope, a package with millions of weekly downloads in Npm, was compromised to steal credentials from developers. To understand the security gaps and the misplaced trust that make recent supply chai","authors_text":"Brendan Saltaformaggio, Omar Alrawi, Ranjita Pai Kasturi, Ruian Duan, Ryan Elder, Wenke Lee","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2002.01139","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5420dd082047d38f52cf434f9ed5e54f2129c8ac6e59157735e0591e6138d258","target":"record","created_at":"2026-07-05T01:56:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"959d3813c77d9e022c433ab97a0174a2b459770d12d8d467335c6db72ab3c9e9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-02-04T06:10:18Z","title_canon_sha256":"7f05be8fe6a1898d839058397d59f05d8fcffad9042325bd6a4fcc3db83e77fa"},"schema_version":"1.0","source":{"id":"2002.01139","kind":"arxiv","version":2}},"canonical_sha256":"b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b6bb24df6bf37209af4780eeb088c55b915f7b6a8613a681583753aae9ef2289","first_computed_at":"2026-07-05T01:56:28.977214Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:56:28.977214Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"oE/uqqzvc6kSPMhBLAEuhwa19yG0zQc2LlwCp8jGa4b1DZAK/N6P1PzE7nMyjfd8CBlc2zcvYRBGHTigjn5gAg==","signature_status":"signed_v1","signed_at":"2026-07-05T01:56:28.977645Z","signed_message":"canonical_sha256_bytes"},"source_id":"2002.01139","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5420dd082047d38f52cf434f9ed5e54f2129c8ac6e59157735e0591e6138d258","sha256:b2ff4d6eca2ef704c71dfa0a8106f310edf531b4b9a5182fbd0598c23cfe26b7"],"state_sha256":"5d9f1494c7bf91a0620adac5a35b0f5355ea4f1cb706e1661447a8d833de6495"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"V6sHBeriX1BbxBDnlfQdU2LYr4Bu+hAcpj3lcis0U5VDGwHNBN+TfO+XZSsJzGzG2A0zU27Jn0j3zW+QJPT6BA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-13T22:50:02.522044Z","bundle_sha256":"80a4368110d79cdeb297d1a707aed635558fc97176616c0274c8a787d0ba02d6"}}