{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:X4XRTSII67ASGEO5ISMUNIPQIJ","short_pith_number":"pith:X4XRTSII","canonical_record":{"source":{"id":"2503.00324","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-01T03:20:42Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"48bc935c61eb06d490947335111edd9318268e08657ce190d2ac68c59e42c18d","abstract_canon_sha256":"f3aa6ecc5d36c1d4526dac92772ab4c3287ef34b8fcd4b05733317d2065a65c6"},"schema_version":"1.0"},"canonical_sha256":"bf2f19c908f7c12311dd449946a1f0425e7fa2a4129eaaf65f877693fffc0720","source":{"kind":"arxiv","id":"2503.00324","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.00324","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"arxiv_version","alias_value":"2503.00324v1","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.00324","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_12","alias_value":"X4XRTSII67AS","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_16","alias_value":"X4XRTSII67ASGEO5","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_8","alias_value":"X4XRTSII","created_at":"2026-07-05T10:22:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:X4XRTSII67ASGEO5ISMUNIPQIJ","target":"record","payload":{"canonical_record":{"source":{"id":"2503.00324","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-01T03:20:42Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"48bc935c61eb06d490947335111edd9318268e08657ce190d2ac68c59e42c18d","abstract_canon_sha256":"f3aa6ecc5d36c1d4526dac92772ab4c3287ef34b8fcd4b05733317d2065a65c6"},"schema_version":"1.0"},"canonical_sha256":"bf2f19c908f7c12311dd449946a1f0425e7fa2a4129eaaf65f877693fffc0720","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:22:20.781083Z","signature_b64":"ryYO8u/EERTXFcSvKnZ7Km8NuKk//iT8dDsaukZe0Hyw2YgNUv58dlEdJX+h3GvREXKdtj1nEBUazlTbpuAJCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bf2f19c908f7c12311dd449946a1f0425e7fa2a4129eaaf65f877693fffc0720","last_reissued_at":"2026-07-05T10:22:20.780470Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:22:20.780470Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.00324","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:22:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4/Zi06nQNM+7Yd4LE0UXWMo2bTkuglnEdBxQ9I+dGetlLgpD7W5O7DUSpmgTJJ9jxWXgyaQC3bwd6pNLKF74Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T11:02:27.710999Z"},"content_sha256":"9a8cbfdcecd61b3b36a3cbee372581d93fa45199597b22773a81599ea1e8fc58","schema_version":"1.0","event_id":"sha256:9a8cbfdcecd61b3b36a3cbee372581d93fa45199597b22773a81599ea1e8fc58"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:X4XRTSII67ASGEO5ISMUNIPQIJ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"DySec: A Machine Learning-based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Chadni Islam, Gowri Ramachandran, Raja Jurdak, Sk Tanzir Mehedi","submitted_at":"2025-03-01T03:20:42Z","abstract_excerpt":"Malicious Python packages make software supply chains vulnerable by exploiting trust in open-source repositories like Python Package Index (PyPI). Lack of real-time behavioral monitoring makes metadata inspection and static code analysis inadequate against advanced attack strategies such as typosquatting, covert remote access activation, and dynamic payload generation. To address these challenges, we introduce DySec, a machine learning (ML)-based dynamic analysis framework for PyPI that uses eBPF kernel and user-level probes to monitor behaviors during package installation. By capturing 36 rea"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.00324","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.00324/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:22:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"TTTH0L52FU8aG/r5HQXpVUBeEBHFGdshU8vfkXoU43fjdm+UnR3uXspfdPU2CiYLaXHCdwMTyWUHrLP/ugc5AA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T11:02:27.711533Z"},"content_sha256":"afac8bed1ca74b79dcd9ad22ae306496b9cab5d08a61a478ae745ed4623174df","schema_version":"1.0","event_id":"sha256:afac8bed1ca74b79dcd9ad22ae306496b9cab5d08a61a478ae745ed4623174df"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/bundle.json","state_url":"https://pith.science/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T11:02:27Z","links":{"resolver":"https://pith.science/pith/X4XRTSII67ASGEO5ISMUNIPQIJ","bundle":"https://pith.science/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/bundle.json","state":"https://pith.science/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/X4XRTSII67ASGEO5ISMUNIPQIJ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:X4XRTSII67ASGEO5ISMUNIPQIJ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f3aa6ecc5d36c1d4526dac92772ab4c3287ef34b8fcd4b05733317d2065a65c6","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-01T03:20:42Z","title_canon_sha256":"48bc935c61eb06d490947335111edd9318268e08657ce190d2ac68c59e42c18d"},"schema_version":"1.0","source":{"id":"2503.00324","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.00324","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"arxiv_version","alias_value":"2503.00324v1","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.00324","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_12","alias_value":"X4XRTSII67AS","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_16","alias_value":"X4XRTSII67ASGEO5","created_at":"2026-07-05T10:22:20Z"},{"alias_kind":"pith_short_8","alias_value":"X4XRTSII","created_at":"2026-07-05T10:22:20Z"}],"graph_snapshots":[{"event_id":"sha256:afac8bed1ca74b79dcd9ad22ae306496b9cab5d08a61a478ae745ed4623174df","target":"graph","created_at":"2026-07-05T10:22:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.00324/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malicious Python packages make software supply chains vulnerable by exploiting trust in open-source repositories like Python Package Index (PyPI). Lack of real-time behavioral monitoring makes metadata inspection and static code analysis inadequate against advanced attack strategies such as typosquatting, covert remote access activation, and dynamic payload generation. To address these challenges, we introduce DySec, a machine learning (ML)-based dynamic analysis framework for PyPI that uses eBPF kernel and user-level probes to monitor behaviors during package installation. By capturing 36 rea","authors_text":"Chadni Islam, Gowri Ramachandran, Raja Jurdak, Sk Tanzir Mehedi","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-01T03:20:42Z","title":"DySec: A Machine Learning-based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.00324","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9a8cbfdcecd61b3b36a3cbee372581d93fa45199597b22773a81599ea1e8fc58","target":"record","created_at":"2026-07-05T10:22:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f3aa6ecc5d36c1d4526dac92772ab4c3287ef34b8fcd4b05733317d2065a65c6","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-01T03:20:42Z","title_canon_sha256":"48bc935c61eb06d490947335111edd9318268e08657ce190d2ac68c59e42c18d"},"schema_version":"1.0","source":{"id":"2503.00324","kind":"arxiv","version":1}},"canonical_sha256":"bf2f19c908f7c12311dd449946a1f0425e7fa2a4129eaaf65f877693fffc0720","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bf2f19c908f7c12311dd449946a1f0425e7fa2a4129eaaf65f877693fffc0720","first_computed_at":"2026-07-05T10:22:20.780470Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:22:20.780470Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ryYO8u/EERTXFcSvKnZ7Km8NuKk//iT8dDsaukZe0Hyw2YgNUv58dlEdJX+h3GvREXKdtj1nEBUazlTbpuAJCA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:22:20.781083Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.00324","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9a8cbfdcecd61b3b36a3cbee372581d93fa45199597b22773a81599ea1e8fc58","sha256:afac8bed1ca74b79dcd9ad22ae306496b9cab5d08a61a478ae745ed4623174df"],"state_sha256":"64076e9f770ea1400e59078e8abf52a8dbe254a8d52d55807c0d32df527b08ca"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nbrRUIOvAVxi/a2MxVWzQQkIMWSXAEEGdVLVLPKj0TjQKP1Olnp4pnrBqJ6yibywPKfYntqiHVfK+RXt3YkOCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T11:02:27.715519Z","bundle_sha256":"1cf808b5c30511e8b85d9a3bd96e2a5aadd9ff80434dbe67ace7a5498ebdd3af"}}