{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:XDRQR4LVGNWD2QGKSLDTT3BUZ4","short_pith_number":"pith:XDRQR4LV","canonical_record":{"source":{"id":"2309.11021","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-09-20T02:51:02Z","cross_cats_sorted":[],"title_canon_sha256":"639d9d63e46f5963e5387c93a7974f2909052a0e21c5c99fca41ddb873fd6074","abstract_canon_sha256":"1abcb226883f9ef95ed764da17527fc6a462a70474ae8103f0fccafadbdfa2f9"},"schema_version":"1.0"},"canonical_sha256":"b8e308f175336c3d40ca92c739ec34cf211a9e16910742e653580452e41adeca","source":{"kind":"arxiv","id":"2309.11021","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.11021","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"arxiv_version","alias_value":"2309.11021v1","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.11021","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_12","alias_value":"XDRQR4LVGNWD","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_16","alias_value":"XDRQR4LVGNWD2QGK","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_8","alias_value":"XDRQR4LV","created_at":"2026-07-05T06:52:29Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:XDRQR4LVGNWD2QGKSLDTT3BUZ4","target":"record","payload":{"canonical_record":{"source":{"id":"2309.11021","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-09-20T02:51:02Z","cross_cats_sorted":[],"title_canon_sha256":"639d9d63e46f5963e5387c93a7974f2909052a0e21c5c99fca41ddb873fd6074","abstract_canon_sha256":"1abcb226883f9ef95ed764da17527fc6a462a70474ae8103f0fccafadbdfa2f9"},"schema_version":"1.0"},"canonical_sha256":"b8e308f175336c3d40ca92c739ec34cf211a9e16910742e653580452e41adeca","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:52:29.971592Z","signature_b64":"wZmFaLDcGx7pM2E808WyNuuQ6/bUwh2Yo9E1Z+YsVg8C52r8MGPCOAX9hXhmwPcb1gXrCU58hYqbztdqMTqSBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b8e308f175336c3d40ca92c739ec34cf211a9e16910742e653580452e41adeca","last_reissued_at":"2026-07-05T06:52:29.971162Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:52:29.971162Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2309.11021","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:52:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Af4IUbzO4NBa/FDBj09oR41n6sPHDnnXUS3TQPPqS4FdCsYEHG85lrujh7/J0kDKy9B5cp/oyhtXh8Jbh+MvBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T19:46:52.203076Z"},"content_sha256":"3b48e732a93d62415ef41aff6d384cc075649d6e67412c9b5cbe074abab05f3d","schema_version":"1.0","event_id":"sha256:3b48e732a93d62415ef41aff6d384cc075649d6e67412c9b5cbe074abab05f3d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:XDRQR4LVGNWD2QGKSLDTT3BUZ4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Empirical Study of Malicious Code In PyPI Ecosystem","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Cheng Huang, Chengwei Liu, Wenbo Guo, Yang Liu, Yong Fang, Zhengzi Xu","submitted_at":"2023-09-20T02:51:02Z","abstract_excerpt":"PyPI provides a convenient and accessible package management platform to developers, enabling them to quickly implement specific functions and improve work efficiency. However, the rapid development of the PyPI ecosystem has led to a severe problem of malicious package propagation. Malicious developers disguise malicious packages as normal, posing a significant security risk to end-users.\n  To this end, we conducted an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem. We first built an automated data collection framework "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.11021","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2309.11021/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:52:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uxZ9BpOtsjm3WLZ1CR0Cpdo3BZU3+Mh4LZnQDiV77hjNVfmN0RjW9smEPmHl8ram7gFfaKQT0rnaHC0ragSiCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T19:46:52.203572Z"},"content_sha256":"425249901d1c16499bd587c2d608fbfdfd1506f0569635ad985b1cfb118bf40a","schema_version":"1.0","event_id":"sha256:425249901d1c16499bd587c2d608fbfdfd1506f0569635ad985b1cfb118bf40a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/bundle.json","state_url":"https://pith.science/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T19:46:52Z","links":{"resolver":"https://pith.science/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4","bundle":"https://pith.science/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/bundle.json","state":"https://pith.science/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XDRQR4LVGNWD2QGKSLDTT3BUZ4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:XDRQR4LVGNWD2QGKSLDTT3BUZ4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1abcb226883f9ef95ed764da17527fc6a462a70474ae8103f0fccafadbdfa2f9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-09-20T02:51:02Z","title_canon_sha256":"639d9d63e46f5963e5387c93a7974f2909052a0e21c5c99fca41ddb873fd6074"},"schema_version":"1.0","source":{"id":"2309.11021","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.11021","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"arxiv_version","alias_value":"2309.11021v1","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.11021","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_12","alias_value":"XDRQR4LVGNWD","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_16","alias_value":"XDRQR4LVGNWD2QGK","created_at":"2026-07-05T06:52:29Z"},{"alias_kind":"pith_short_8","alias_value":"XDRQR4LV","created_at":"2026-07-05T06:52:29Z"}],"graph_snapshots":[{"event_id":"sha256:425249901d1c16499bd587c2d608fbfdfd1506f0569635ad985b1cfb118bf40a","target":"graph","created_at":"2026-07-05T06:52:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2309.11021/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"PyPI provides a convenient and accessible package management platform to developers, enabling them to quickly implement specific functions and improve work efficiency. However, the rapid development of the PyPI ecosystem has led to a severe problem of malicious package propagation. Malicious developers disguise malicious packages as normal, posing a significant security risk to end-users.\n  To this end, we conducted an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem. We first built an automated data collection framework ","authors_text":"Cheng Huang, Chengwei Liu, Wenbo Guo, Yang Liu, Yong Fang, Zhengzi Xu","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-09-20T02:51:02Z","title":"An Empirical Study of Malicious Code In PyPI Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.11021","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3b48e732a93d62415ef41aff6d384cc075649d6e67412c9b5cbe074abab05f3d","target":"record","created_at":"2026-07-05T06:52:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1abcb226883f9ef95ed764da17527fc6a462a70474ae8103f0fccafadbdfa2f9","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-09-20T02:51:02Z","title_canon_sha256":"639d9d63e46f5963e5387c93a7974f2909052a0e21c5c99fca41ddb873fd6074"},"schema_version":"1.0","source":{"id":"2309.11021","kind":"arxiv","version":1}},"canonical_sha256":"b8e308f175336c3d40ca92c739ec34cf211a9e16910742e653580452e41adeca","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b8e308f175336c3d40ca92c739ec34cf211a9e16910742e653580452e41adeca","first_computed_at":"2026-07-05T06:52:29.971162Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:52:29.971162Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"wZmFaLDcGx7pM2E808WyNuuQ6/bUwh2Yo9E1Z+YsVg8C52r8MGPCOAX9hXhmwPcb1gXrCU58hYqbztdqMTqSBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T06:52:29.971592Z","signed_message":"canonical_sha256_bytes"},"source_id":"2309.11021","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3b48e732a93d62415ef41aff6d384cc075649d6e67412c9b5cbe074abab05f3d","sha256:425249901d1c16499bd587c2d608fbfdfd1506f0569635ad985b1cfb118bf40a"],"state_sha256":"a5294954223222fa71948169a4f6ae462bd713529bee7021fe59301919bc3e9a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"L9lwH20gZMrwZxJShm0UbyfiyRtb4jUyALe+1Nq8wQjtqqt+5UkTGQuoFKwT5GlFLDjliA4WhO8+QqYr+iDICw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T19:46:52.209034Z","bundle_sha256":"d50fc817d8ed5e53ec91923ae708854096d1b61bc28c869ac1e17549fb24bdda"}}