{"as_of":"2026-08-13T14:04:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:9256064ada31fb480c6a3fc0064b5b4f5b8aefc6ecb10d326f7d7cbfbcb6073f","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":10,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":10,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":10,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":10,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T11:26:16.929297Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-20T09:03:10.607255Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-12T11:26:16.929297Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages","venue":null,"work_id":null,"year":2002},"citing_paper":{"arxiv_id":"2411.18269","last_updated":"2024-11-27T12:04:37Z","snapshot_observed_at":"2026-08-12T11:19:42.557913Z","submitted_at":"2024-11-27T12:04:37Z","title":"Hidden Data Privacy Breaches in Federated Learning","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-12T11:26:16.929297Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2411.18269"},"observation_digest":"sha256:98d1009e8434a4ec24ac25e2f2fe015a800f32feec7f478b63accb28ce62db3b","observation_id":"cf1294ad-a3bc-4314-b819-d1e829d302e4","resolution":{"observed_at":"2026-08-12T11:26:16.929297Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-11T20:54:13.458679Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2412.05259","last_updated":"2024-12-06T18:49:06Z","snapshot_observed_at":"2026-08-12T21:18:22.057671Z","submitted_at":"2024-12-06T18:49:06Z","title":"A Machine Learning-Based Approach For Detecting Malicious PyPI Packages","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-11T20:54:13.458679Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2412.05259"},"observation_digest":"sha256:bf19ef6714907012b9987fb086595bc67d0fa77243803e658b115bbc290ff476","observation_id":"473639e0-6caa-44c5-8ded-8f79251d6367","resolution":{"observed_at":"2026-08-11T20:54:13.458679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-07T00:41:17.469971Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages,","venue":null,"work_id":null,"year":2002},"citing_paper":{"arxiv_id":"2506.12995","last_updated":"2025-06-15T23:22:25Z","snapshot_observed_at":"2026-08-13T04:08:32.574668Z","submitted_at":"2025-06-15T23:22:25Z","title":"Open Source, Open Threats? Investigating Security Challenges in Open-Source Software","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T00:41:17.469971Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2506.12995"},"observation_digest":"sha256:6ef70c92e14dab2c0e965b057b5409dea1f8915f325c2decc2ddcd4d0e0fe993","observation_id":"6240d4cf-84af-4617-94e7-d08fbd221131","resolution":{"observed_at":"2026-08-07T00:41:17.469971Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-06T21:38:27.173057Z","title":"Towards measuring supply chain attacks on package man- agers for interpreted languages,","venue":null,"work_id":null,"year":2002},"citing_paper":{"arxiv_id":"2506.23683","last_updated":"2025-06-30T10:04:38Z","snapshot_observed_at":"2026-08-11T22:46:44.732415Z","submitted_at":"2025-06-30T10:04:38Z","title":"Threadbox: Sandboxing for Modular Security","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T21:38:27.173057Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2506.23683"},"observation_digest":"sha256:41e51c1072020d0e9133690e51fbf6cdfd61953bb53e6a4da794fb63a6218874","observation_id":"1b2bfdcc-8eed-4b13-9bc3-b650609968de","resolution":{"observed_at":"2026-08-06T21:38:27.173057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-05T14:22:34.921518Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2508.21417","last_updated":"2025-08-29T08:38:58Z","snapshot_observed_at":"2026-08-08T11:01:31.511538Z","submitted_at":"2025-08-29T08:38:58Z","title":"An Empirical Study of Vulnerable Package Dependencies in LLM Repositories","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-05T14:22:34.921518Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2508.21417"},"observation_digest":"sha256:7cf9bd002613aa32ca968d3efe7edd317ae8d6086c63a3ac544c4f7bb62b46ac","observation_id":"9e7600a9-f38f-4298-8196-22b93cf3a4a5","resolution":{"observed_at":"2026-08-05T14:22:34.921518Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-08-04T19:20:55.580945Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2509.09322","last_updated":"2025-09-11T10:12:56Z","snapshot_observed_at":"2026-08-10T01:21:24.619322Z","submitted_at":"2025-09-11T10:12:56Z","title":"ORCA: Unveiling Obscure Containers In The Wild","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-04T19:20:55.580945Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2509.09322"},"observation_digest":"sha256:d74ebda4785dbd8356708cfa905de75db18a5347d5c572d455ee26546e4475d7","observation_id":"faec0607-c503-46f8-9a12-9ef74dcf28a8","resolution":{"observed_at":"2026-08-04T19:20:55.580945Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":"2002.01139","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages","venue":null,"work_id":"50b95572-4e41-4428-8795-9dd541228613","year":2002},"citing_paper":{"arxiv_id":"2510.16558","last_updated":"2026-04-27T18:24:07Z","snapshot_observed_at":"2026-07-06T22:33:28.866887Z","submitted_at":"2025-10-18T16:09:05Z","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-18T06:10:58.928119Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2510.16558"},"observation_digest":"sha256:85e32357a4934d37e5f20ff9e802275a6c74c673d70574ca09ecd743b888debd","observation_id":"1ce4ac46-62c8-46b7-bad6-12a9bb5fe6e5","resolution":{"observed_at":"2026-05-18T06:12:26.314028Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":"2002.01139","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages","venue":null,"work_id":"50b95572-4e41-4428-8795-9dd541228613","year":2002},"citing_paper":{"arxiv_id":"2605.12875","last_updated":"2026-05-13T01:44:10Z","snapshot_observed_at":"2026-07-06T23:24:32.412966Z","submitted_at":"2026-05-13T01:44:10Z","title":"Do Skill Descriptions Tell the Truth? Detecting Undisclosed Security Behaviors in Code-Backed LLM Skills","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-14T19:06:00.332789Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2605.12875"},"observation_digest":"sha256:2e819eac3634e5ac854f7a759369b0b49334073ffb1b50f2de5830778276f156","observation_id":"9287908d-20d1-45e9-9aa8-fce9c6b359d8","resolution":{"observed_at":"2026-05-14T19:07:51.255301Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":"2002.01139","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages","venue":null,"work_id":"50b95572-4e41-4428-8795-9dd541228613","year":2002},"citing_paper":{"arxiv_id":"2605.18583","last_updated":"2026-05-18T16:00:41Z","snapshot_observed_at":"2026-07-06T23:29:29.105126Z","submitted_at":"2026-05-18T16:00:41Z","title":"Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-20T08:59:54.715974Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2605.18583"},"observation_digest":"sha256:3e8b931b7f85a967691671ae32fd7e06ab0465ae314ff5f66c4b9eb9bf0eca0e","observation_id":"31f74490-5056-47d0-ba18-6220a5a86f87","resolution":{"observed_at":"2026-05-20T09:03:10.609406Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2002.01139","snapshot_observed_at":"2026-07-12T03:06:24.801039Z","title":"Towards measuring supply chain attacks on package managers for interpreted languages,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.03350","last_updated":"2026-07-03T14:05:54Z","snapshot_observed_at":"2026-08-13T10:01:45.935399Z","submitted_at":"2026-07-03T14:05:54Z","title":"LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-12T03:06:24.801039Z"},"links":{"cited_paper":"/paper/2002.01139","citing_paper":"/paper/2607.03350"},"observation_digest":"sha256:eb5d8817ad33aa00259cca94caf09509bc291888c69029d5ea242d0e757ec32c","observation_id":"63ecb9f2-f751-4b89-80c2-6201fa77750e","resolution":{"observed_at":"2026-07-12T03:06:24.801039Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2002.01139/citation-record","integrity":"/paper/2002.01139/integrity","json":"/paper/2002.01139/citation-record.json","paper":"/paper/2002.01139"},"outbound":[],"paper":{"arxiv_id":"2002.01139","last_updated":"2020-12-02T17:40:57Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T23:08:54.384750Z","submitted_at":"2020-02-04T06:10:18Z","title":"Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 10 inbound Pith citation observations for arXiv:2002.01139."}