{"as_of":"2026-08-10T19:38:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a2afc9dbc9e32664ca1f16ee3b781a8ed3b5672ca89cc337a764eeacd5a8ccb7","coverage":[{"denominator":92,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":92,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T14:47:42.002141Z","state":"measured"},{"denominator":94,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":94,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T11:18:12.942538Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.06662","snapshot_observed_at":"2026-08-04T11:18:12.942538Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.08609","last_updated":"2026-05-24T16:38:01Z","snapshot_observed_at":"2026-08-06T08:21:36.313001Z","submitted_at":"2025-10-07T14:37:03Z","title":"Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-04T11:18:12.942538Z"},"links":{"cited_paper":"/paper/2502.06662","citing_paper":"/paper/2510.08609"},"observation_digest":"sha256:668c77718d569104fca6942e7ba02e24fd1d37dc4c946d2e4f349f2f5cf623f7","observation_id":"1a97e9f0-a892-46fd-a680-b3a92a6956d3","resolution":{"observed_at":"2026-08-04T11:18:12.942538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.06662","snapshot_observed_at":"2026-08-02T02:11:22.936754Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.936754Z"},"links":{"cited_paper":"/paper/2502.06662","citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:1e0a8d7eee664acadec6fc9d375f6d419efdeea9bbfe88a5bda95127dd7276e5","observation_id":"770379e0-39b4-4c5e-b3d7-42268f607f22","resolution":{"observed_at":"2026-08-02T02:11:22.936754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2502.06662/citation-record","integrity":"/paper/2502.06662/integrity","json":"/paper/2502.06662/citation-record.json","paper":"/paper/2502.06662"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.705065Z","title":null,"venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.705065Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:465ac7c6c83ad32acf1353b226ce0a3f4c77c3cba2a08d4f1bb9db2312d2a184","observation_id":"5f84f608-cc15-4c68-bb1a-1c7149e95fa4","resolution":{"observed_at":"2026-08-08T14:47:41.705065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.671718Z","title":"https://doi.org/10.1109/MSR52588.2021.00037 Chris Bogart, Christian Kästner, James D","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.671718Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c9edab69e172e8f04cc56de489afb1859bcb5d6b00b5518b25855ef31e2a80a3","observation_id":"55d628c7-4f85-425e-86c5-367c777e5efc","resolution":{"observed_at":"2026-08-08T14:47:41.671718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.675555Z","title":"ACM Trans","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.675555Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8efd1a1f329b2b1f1de9f705d953cdfcff7d9dd13040cf81dc72c383998352d9","observation_id":"3f55bf83-a250-441c-a6dc-4c461e550d10","resolution":{"observed_at":"2026-08-08T14:47:41.675555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.693288Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.693288Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a646dceedf6613a8f1bdcc1f058e9a762aa57d6c2beff9767dbef4216015f486","observation_id":"be6d0158-7632-489d-a79d-3d4ea5062697","resolution":{"observed_at":"2026-08-08T14:47:41.693288Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.701377Z","title":"In 37th IEEE/ACM International Conference on Software Engineering, ICSE 2015, Florence, Italy, May 16-24, 2015, Volume","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.701377Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:35bee50e9273db9800d3c4c967bb6f54281d3f688831180462d04edaec603959","observation_id":"d38489d8-b673-45ec-be7c-7a8ab7e27332","resolution":{"observed_at":"2026-08-08T14:47:41.701377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.717307Z","title":"Retrieved December 11, 2023 from https://crashoverride.com/blog/dependency-pinning-only-works-if-you-actually-review-the-updates Erik DeBill","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.717307Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:10345f4cf1a07243454ed442582413a1dd7b3d2c60bed9a318280dde5c0b944f","observation_id":"1d4088a3-9085-4811-84b1-4d4df995aad5","resolution":{"observed_at":"2026-08-08T14:47:41.717307Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.721413Z","title":"Retrieved May 23, 2024 from http://www.modulecounts.com/ Alexandre Decan and Tom Mens","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.721413Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:533d18e44424436a9a100ad6080b97631989535f9dc554d3e45802ce39fba32f","observation_id":"ca4f89e5-abf4-4bae-9e7c-d01634f72327","resolution":{"observed_at":"2026-08-08T14:47:41.721413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.725218Z","title":"Software Eng","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.725218Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:a3b6ca7cbe6657d272c6dc1b36a951500647afb07e7f4a5826998d49d64b5072","observation_id":"5a0b1e96-2899-40ba-b9dd-87876e89c03d","resolution":{"observed_at":"2026-08-08T14:47:41.725218Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.736391Z","title":"In Proceedings of the 16th International Conference on Mining Software Repositories, MSR 2019, 26-27 May 2019, Montreal, Canada","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.736391Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:77e50e7425693aad808760f2bf348d4b195f323a32379a6ffc0d3641aefab8fa","observation_id":"8886afe1-ca8c-4a12-b49f-c13b75b2ceec","resolution":{"observed_at":"2026-08-08T14:47:41.736391Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.743507Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.743507Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1c5f12ca81bfdf7466cdf097c52b65ae20b7ed62183cb477fc68478319cfbf10","observation_id":"d4740adb-f240-475b-aa79-eb308dd75106","resolution":{"observed_at":"2026-08-08T14:47:41.743507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.747476Z","title":"In ISSTA ’20: 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, USA, July 18-22, 2020","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.747476Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d30c5ab3f2484b8898e28d427ec24f0bee33b33c22043cccf71da746f78744e7","observation_id":"90d803f0-1fb4-4af3-82f8-b54f6c4297d5","resolution":{"observed_at":"2026-08-08T14:47:41.747476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.307856Z","title":"login Usenix Mag","venue":null,"work_id":"33826523-d9e9-4bf2-bbe2-4e4b3e73d6c0","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.751370Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:e6d556102ead5e65efea4fac0fc018fcc85e7f7c895376970d4cb7cf9b9ed366","observation_id":"c18c0203-fe6d-48e2-8d19-1adaeefd572d","resolution":{"observed_at":"2026-08-08T14:47:47.312726Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.279820Z","title":"Retrieved April 21, 2024 from https://github.com/advisories Google","venue":null,"work_id":"3435855d-c379-461e-bdca-a9b8c570b6f1","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.762788Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:7a6e0eb426cee2857a17633476321bc83ab9449427226b47b4f451c002f20235","observation_id":"196a584a-3d4c-442a-9188-923f0c89fa13","resolution":{"observed_at":"2026-08-08T14:47:47.284091Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.269341Z","title":"Retrieved September 8, 2024 from https://cloud.google.com/security/products/ assured-open-source-software Hacker News","venue":null,"work_id":"9f1634e8-672c-4280-b5d8-5e5592f66de4","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.766283Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c24bde87321a7394090d4f541d56c3f66580976fc54931b56031825bff828013","observation_id":"21394ee7-e446-4ed2-a3dc-170633eedc49","resolution":{"observed_at":"2026-08-08T14:47:47.273547Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.259288Z","title":"Retrieved December 11, 2023 from https://news.ycombinator.com/item?id=14759329 Hacker News","venue":null,"work_id":"9928ec5f-321b-44cf-8fe0-06b658e1c30c","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.769527Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:81aa04d7bda8118375e95ff5ce177c00fb29ad664b614b8adb817ddc4e66a008","observation_id":"07e1a75b-021d-4357-b1f3-cfdc16269a80","resolution":{"observed_at":"2026-08-08T14:47:47.263235Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.248535Z","title":"Retrieved December 13, 2023 from https://news","venue":null,"work_id":"10ae5214-cce9-4b8d-8cdd-9881e5f3da60","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.773090Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:be0d27a7c0a315a17d4ebc423749245ab0262802c2d2f7e2edaa7087570497c7","observation_id":"a12fe0da-f2a9-4506-9a1d-98e4a4cd87df","resolution":{"observed_at":"2026-08-08T14:47:47.252350Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.776362Z","title":"In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.776362Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3ba3f384b4abef2bd5489e9c40e0940c9d1558c08621454da5a346302fad0eab","observation_id":"23f0729c-c62d-41ad-bd51-c0a71007498e","resolution":{"observed_at":"2026-08-08T14:47:41.776362Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2023.32781","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.416622Z","title":"IEEE Trans","venue":null,"work_id":"253d3338-5bd7-424f-812e-edf352fc7580","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.780201Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:536b6f91a094e1ffc0812716694460dd64342337be3313c55fdcdebbd671da0a","observation_id":"859f7a2f-2f94-4a38-a0c7-6cac63199fdd","resolution":{"observed_at":"2026-08-08T14:47:46.422456Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.238153Z","title":null,"venue":null,"work_id":"233755d6-6c71-488a-b94e-cfcaf7baabe7","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.784809Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:2b780820f0ca868627d2a53d164d40c6d300e95494fd53561559c9cd1864dd46","observation_id":"4bbed8ab-84c7-45bf-9311-3569e21fa9ac","resolution":{"observed_at":"2026-08-08T14:47:47.241865Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1908.04856","last_updated":"2019-08-13T20:59:33Z","snapshot_observed_at":"2026-08-03T06:58:20.401333Z","submitted_at":"2019-08-13T20:59:33Z","title":"Exploit Prediction Scoring System (EPSS)","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.04856","snapshot_observed_at":"2026-08-08T14:47:41.788915Z","title":"CoRR abs/1908.04856 (2019)","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.788915Z"},"links":{"cited_paper":"/paper/1908.04856","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:799d52bc1127e1e37a7d2ea21ab9fde8830c88b5a2c8c6b4b42b4326d4205030","observation_id":"d40569ff-8708-4d37-9959-ce9f79e86575","resolution":{"observed_at":"2026-08-08T14:47:41.788915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.793741Z","title":"IEEE Trans","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.793741Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5644c92f0366e95925298f1700be4042a9dc66c0f2d9511b9ef1b5cb8f326fdf","observation_id":"2cde4814-9ecd-4f22-8988-4c61d25b96bb","resolution":{"observed_at":"2026-08-08T14:47:41.793741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.797776Z","title":"ACM Trans","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.797776Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:233117e9f1eaf682ad3991c3e7f7cd2509e32adbb1263f7c33ef7936e00b77ba","observation_id":"1e407a8d-532f-428c-91a6-8fc5d1deff36","resolution":{"observed_at":"2026-08-08T14:47:41.797776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.227122Z","title":"In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, Seattle, W A, USA, July 17-21,","venue":null,"work_id":"1dffe6e1-575d-4ceb-bcad-93e41b9f3133","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.801334Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8653632fef195063e087f961d516c39b181f5a75fe76a38fc48ae7dc98eb11bc","observation_id":"36f372f6-1cf3-4141-a2c2-d23b27ea625e","resolution":{"observed_at":"2026-08-08T14:47:47.231391Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.805408Z","title":"https://doi.org/10.1145/3597926.3598147 Dezhen Kong, Jiakun Liu, Lingfeng Bao, and David Lo","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.805408Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c11c281c47dec1d8598480fe3c35343309048513cf24f5c6c6dfbd12959c14fa","observation_id":"8606aeba-2443-41f4-88f2-12029d620fa9","resolution":{"observed_at":"2026-08-08T14:47:41.805408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.14431","last_updated":"2024-10-14T13:28:59Z","snapshot_observed_at":"2026-07-06T19:06:06.424850Z","submitted_at":"2024-08-26T17:18:38Z","title":"Towards Better Comprehension of Breaking Changes in the NPM Ecosystem","version":2},"cited_work":{"arxiv_id":"2408.14431","doi":null,"metadata_source":"pith","pith_arxiv_id":"2408.14431","snapshot_observed_at":"2026-08-08T14:47:46.070167Z","title":"Towards Better Comprehension of Breaking Changes in the NPM Ecosystem","venue":"cs.SE","work_id":"b0192d16-ebf3-4dee-9e1e-62bbe3a9f258","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.809215Z"},"links":{"cited_paper":"/paper/2408.14431","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:db1c5587c3982335d4f2eb8a3816d18c74a62ab9500aa9388c5ece305efd187b","observation_id":"caa19653-54b7-40e7-80d8-901a6ac86d1c","resolution":{"observed_at":"2026-08-08T14:47:46.074635Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.813093Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.813093Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1a5f61404b8ba120876cd0744f0b993d03801b9aed7c2f0f750acc35a6028388","observation_id":"58708245-d033-487b-96b0-c6e96a4c5c0e","resolution":{"observed_at":"2026-08-08T14:47:41.813093Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.216055Z","title":"In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, Proc","venue":null,"work_id":"60c71776-1a9e-425f-9d3b-964b8cc33091","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.816792Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b163c1406045c23941cfc518416026dcf2d77d46635c916242b9b3072bf32090","observation_id":"3288c5b4-5f2e-40c0-beef-d31e937ac696","resolution":{"observed_at":"2026-08-08T14:47:47.220238Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.820581Z","title":"https://doi.org/10.1109/SP46215.2023.10179304 Jasmine Latendresse, Suhaib Mujahid, Diego Elias Costa, and Emad Shihab","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.820581Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bd54bfece7ec6cef827f789fb3abc57a59f04c9b6d8315cf9c568d3d753719a6","observation_id":"da2ca4b8-bbaf-4cb0-a585-50f8d65726b9","resolution":{"observed_at":"2026-08-08T14:47:41.820581Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.824112Z","title":"In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.824112Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:10a09fbef764b9d8c07657fc8dafcaa290973592dc0f022ba90ad55d0991084f","observation_id":"b5b388c5-d80c-4f26-a69f-c8afa02a6f5e","resolution":{"observed_at":"2026-08-08T14:47:41.824112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.204544Z","title":"Retrieved December 13, 2023 from https://maxleiter.com/blog/pin- dependencies Chengwei Liu, Sen Chen, Lingling Fan, Bihuan Chen, Yang Liu, and Xin Peng","venue":null,"work_id":"b07c3b2b-ae1f-47a4-a1f2-b7a20a7dafa4","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.827697Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:7a580a7cd9af9375b1bffc7d8320d57e052784ebfc6975b41e890d9611787a9c","observation_id":"74cb0e93-17af-4511-8730-b6950e180821","resolution":{"observed_at":"2026-08-08T14:47:47.208559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.194411Z","title":"Retrieved December 13, 2023 from https://www.lucidchart","venue":null,"work_id":"ba26ef4e-ee91-4cfc-8d48-c91729b75353","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.834921Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c831a6b7eb93b64a2f2b74592912673efb1798dff776b4640cf1e5514a8c64a4","observation_id":"96a9deb6-ff0a-4d6c-91b0-68f850c2e864","resolution":{"observed_at":"2026-08-08T14:47:47.198191Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.697394Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.697394Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5eecc19735378a7b9dc015f51c634a83448f787d14fd798e899ccfa01a872d0f","observation_id":"c907139a-29f1-49b1-b184-630a1581e8a4","resolution":{"observed_at":"2026-08-08T14:47:41.697394Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.184425Z","title":null,"venue":null,"work_id":"1dcafcb9-36f3-443b-bb3b-44607a7c9cfd","year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.838588Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bf42769928d75170748e4ad88f698af74bae66d6b3ae6d699b77f37347116721","observation_id":"69bb8ab5-42dc-4b7a-9ba6-030af1ae7b47","resolution":{"observed_at":"2026-08-08T14:47:47.187689Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.842093Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.842093Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:72a41f1ba954e9d8f6beeefb31e3bb5fc32fa05e1fb9f15deba125f1ae81d253","observation_id":"555e8f4a-a668-4504-b513-71db4ecc4775","resolution":{"observed_at":"2026-08-08T14:47:41.842093Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.850372Z","title":"International Journal of Safety and Security Engineering 11, 5 (2021), 537–545","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.850372Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5e7008bb18ce532d38352e354b118d9be051b47d0c9cb34afb1e8fa8a0e5befc","observation_id":"113264e6-ecb4-4094-8986-328e730f92ba","resolution":{"observed_at":"2026-08-08T14:47:41.850372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.174233Z","title":"In 32nd European Conference on Object-Oriented Programming, ECOOP 2018, July 16-21, 2018, Amsterdam, The Netherlands (LIPIcs, Vol","venue":null,"work_id":"6c72b29f-589b-429f-aa22-c33f180a9c88","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.853952Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:0c50ef5f7b96b39adb3c241b328584d51224fc5fc6aad46ccaeffb5f94b6167b","observation_id":"daf771f2-f24b-4c4a-b2aa-dcec87e0fc94","resolution":{"observed_at":"2026-08-08T14:47:47.178309Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.750096Z","title":"We Feel Like We’re Winging It:","venue":null,"work_id":"bd99c20a-ac15-42e7-9be9-2eb2007fba1b","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.861467Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:585c3611b5ccb1d71d936f4f7884f07ee78afeaf2e0a11667e4380ccfb62610e","observation_id":"61252c29-4b2f-46e8-b8bc-0aa2b99bb989","resolution":{"observed_at":"2026-08-08T14:47:45.753573Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.584594Z","title":"In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE 2017, Urbana, IL, USA, October 30 - November 03, 2017","venue":null,"work_id":"71565ae3-c71e-421e-90bc-3062d2b54548","year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.865314Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:676acfeea71c44e360106a4d77b80e6f171bcc04bee896c899c7989802788021","observation_id":"75f81c12-26fe-4307-909d-2b67786e6b70","resolution":{"observed_at":"2026-08-08T14:47:45.587920Z","resolver_source":"arxiv_id_nonexistent","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3460319","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T05:30:23.456663Z","title":"In ISSTA ’21: 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, Denmark, July 11-17, 2021 , Cristian Cadar and Xiangyu Zhang (Eds.)","venue":null,"work_id":"d655b275-6815-4f0e-8881-792504710341","year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.869552Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:723456d155777eef86866380a6d585082128cddb053e09e75d86c155975a0c64","observation_id":"325435aa-1c4b-4b0c-ba1b-c2e3ef29f8ed","resolution":{"observed_at":"2026-08-08T14:47:42.073955Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.873156Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.873156Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:381619623cb8f583cab9bb461c364548f8bb3436c812dd2210adf05caa5a1627","observation_id":"669127a9-de72-4b2b-a311-987f038a8c48","resolution":{"observed_at":"2026-08-08T14:47:41.873156Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.163420Z","title":null,"venue":null,"work_id":"b7490233-be5c-4879-8e11-2317cf83a826","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.876547Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:93f3ad2ca346d2bc07c98b4171752fa6914fc85ddc2820ef90ae5078947ab012","observation_id":"9898a980-c6e1-4934-8c21-eb4727e76cdc","resolution":{"observed_at":"2026-08-08T14:47:47.167322Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.418943Z","title":"In Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, ESEM 2018, Oulu, Finland, October 11-12, 2018","venue":null,"work_id":"78e18f58-4fa9-4fa5-b1ed-56cfce6858f6","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.880323Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1b87be9d7e14c3d16611b1d08d27ffafa7778d9f2f1aabd9e57467bb0a29788c","observation_id":"923349d3-172d-4a1d-8d4a-b999efd98b25","resolution":{"observed_at":"2026-08-08T14:47:45.422060Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.152080Z","title":"In CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13,","venue":null,"work_id":"39f9de0f-a336-4c79-a435-bd0f36b261ae","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.884068Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:08eac79a1f9c40ee30cd87544b845bf41a6a52f6651ab7e07408d480d9d46720","observation_id":"8826fc05-7e7d-41aa-b5e4-046980d2f60b","resolution":{"observed_at":"2026-08-08T14:47:47.156245Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.219838Z","title":"https://doi.org/10.1145/3372297.3417232 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell","venue":null,"work_id":"372e7770-893a-401d-9bb9-61f443c7b1b5","year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.887786Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4824b1ec42a0630617727f7c02602f3098bdb1df110038108b50374dcd9c3de9","observation_id":"0d8f9953-892e-4bfa-8758-099729bfaa01","resolution":{"observed_at":"2026-08-08T14:47:45.222879Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.065631Z","title":"https://doi.org/10.1109/MSR59073.2023.00073 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell","venue":null,"work_id":"6ae21d63-5b2c-4bd7-802e-4ffb5d5fded9","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.891267Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c061550d69ad073d0def1308c5183587bb6f6ad94a40e773ecec61297c2cfe1d","observation_id":"14b8984a-7949-414c-981a-87ecede5d540","resolution":{"observed_at":"2026-08-08T14:47:45.069011Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.139543Z","title":"Retrieved December 11, 2023 from https://semver.org/ Maciej Radzikowski","venue":null,"work_id":"ffc4c640-8211-4857-9c9d-1957665e0618","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.894679Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1ef2c65496eabec5efa625c41f7446203ae25cbacc95e3c4e3bf3acb8a7e779b","observation_id":"de6731d7-3824-4875-bf93-bfe35d9aac93","resolution":{"observed_at":"2026-08-08T14:47:47.144434Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.128834Z","title":"Retrieved December 13, 2023 from https://betterdev.blog/pin- exact-dependency-versions/ Steven Raemaekers, Arie van Deursen, and Joost Visser","venue":null,"work_id":"da949ce5-db4c-4980-8f7a-541098ab2ae6","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.897906Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:1cdcf6ba172b534a6fc0dc45ededb88290e7126bc0bf42b4b2eb903b2a4f40e7","observation_id":"c5cecf67-c56e-4f01-9735-a0782dcf24f2","resolution":{"observed_at":"2026-08-08T14:47:47.132947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.901246Z","title":null,"venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.901246Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:69d7eb0b608964a79f2575f2e80d3a755acde70761ca62f780a8914a2e249b99","observation_id":"b94949b1-86c4-4e7f-ad3b-f5e4a874b206","resolution":{"observed_at":"2026-08-08T14:47:41.901246Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.116231Z","title":"Retrieved May 23, 2024 from https://developer","venue":null,"work_id":"79ae9cc8-b0ea-4e5e-aa35-963846fdd1b6","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.904631Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3a6c04c53ebece677009e60325e1088aafee529a745a82818d8fac5c340072c0","observation_id":"a44aae65-f132-4eba-8017-5a36187904bd","resolution":{"observed_at":"2026-08-08T14:47:47.121257Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.103633Z","title":"com/dependency-pinning Edgar H Schein","venue":null,"work_id":"ee913079-17e1-412f-bce3-e268a7fdadde","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.908224Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4916d8135547a9796ebc6b2a829ffbbafa5cc363b4c09ebf49c690e75df7785e","observation_id":"61fddeae-0179-4f1c-9adc-296108ac51ae","resolution":{"observed_at":"2026-08-08T14:47:47.107889Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.092101Z","title":"Collective Intelligence 3, 1 (2024), 26339137241231912","venue":null,"work_id":"0073568f-19ee-449a-aae8-49ee23950620","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.911525Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c5d1a3ae52dc332b674d3c64d219be1a4f5681d389d839a47aaa1ae600a63008","observation_id":"d20b2bee-4f50-4e44-a811-f8424d69064a","resolution":{"observed_at":"2026-08-08T14:47:47.096327Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:45.907778Z","title":"In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022, Pittsburgh, PA, USA, May 25-27, 2022","venue":null,"work_id":"fcfc0f80-28d5-43aa-abaf-e9ebaa632bd8","year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.914521Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:288d3a3c2a824a09dcd0a08dace2fab0194cab8dfd14f2cf4b521911b2d21936","observation_id":"27561123-e884-4fea-be27-ae277cb98e5f","resolution":{"observed_at":"2026-08-08T14:47:45.912089Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.054698Z","title":"Retrieved Augest 22, 2023 from https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ Sonatype","venue":null,"work_id":"3b32b99f-4787-410a-a4cd-806dc23a8016","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.927695Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:010f91bec11f471b99704d7d5d4a3a5ee19109cd77d86ea58240d61c112a869e","observation_id":"d732046b-45e9-42cb-be0c-b72111ce1b6f","resolution":{"observed_at":"2026-08-08T14:47:47.060566Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.026643Z","title":"Retrieved May 24, 2024 from https://www.sonatype.com/ blog/software-supply-chain-a-definition-and-introductory-guide Sonatype","venue":null,"work_id":"0531853f-0e38-4cc6-8d0f-ae63c3fd7f09","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.930637Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ecec5aa710c8adc793fce0fb7d02bb657d7ecec3dad82272c08ac3d58051a6f6","observation_id":"5de800df-8ac0-472e-a123-f2d9800980d4","resolution":{"observed_at":"2026-08-08T14:47:47.032182Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"questions/2850948","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.539481Z","title":"com/questions/28509481/should-i-pin-my-python-dependencies-versions Alois Stutzer and Bruno S Frey","venue":null,"work_id":"e2ce3158-8603-4b32-886e-db8534adbd30","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.937646Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:494e68857131a9b7b9c084d1d7bd9ddddbfc89a328a20dd487eda2d9c91a3139","observation_id":"7a4568b7-82fa-4c1f-a105-e1375cafeda0","resolution":{"observed_at":"2026-08-08T14:47:44.544941Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1016/j.socec.2005.11.043","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T05:30:23.456663Z","title":"https://doi.org/doi.org/10.1016/j.socec.2005.11.043 TechTarget","venue":"The Journal of Socio-Economics","work_id":"236db5f7-e225-4fc6-8586-d9f6f27513b2","year":2006},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.940996Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d3b5ec029f98c44e62f9dd8993c736c2d21b35816db9cc955c2626eab8b5cd62","observation_id":"0aefaed7-686c-449b-9b6f-8affe7bb9b1f","resolution":{"observed_at":"2026-08-08T14:47:42.048466Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.012897Z","title":"Retrieved May 22, 2024 from https://www","venue":null,"work_id":"17bfb2df-a453-4e55-ad5d-b7011e17f829","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.944230Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5411f19c83866989462e3ded67292d85a2e46617412ebbcdef1b37673a7fa2f0","observation_id":"a8ac293a-e596-46a3-b3fb-06101f627c64","resolution":{"observed_at":"2026-08-08T14:47:47.017759Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.999913Z","title":"Retrieved August 27, 2024 from https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the- nations-cybersecurity/ David A","venue":null,"work_id":"ca2910f4-367b-46e7-b84b-837dd706e76c","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.947138Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3872d7561f8ee5cf6708a2a8a590a06a1c29e0201421016c1af18dccfa70657a","observation_id":"a6bcc374-f37c-467a-a6d3-56f72e5a4aa6","resolution":{"observed_at":"2026-08-08T14:47:47.004958Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.984738Z","title":"In Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May Proc","venue":null,"work_id":"4c6bcb9f-2300-4ad9-a7a2-4e2a480a8d8a","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.949971Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b2a25c32f6f82d501a4f5e80a3e99d63f5809890c2b17e6f44952e6c7a5b6e4d","observation_id":"12026f34-d8d6-4466-bc96-8de8bfa49a1e","resolution":{"observed_at":"2026-08-08T14:47:46.990076Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.423371Z","title":"https://doi.org/10.1109/ICSE.2019.00048 Marat Valiev, Bogdan Vasilescu, and James D","venue":null,"work_id":"a5789cee-90d1-4296-8a85-e94678b3068e","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.952909Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b20759a376104092021dd8e829c4e108f2870bda67e550da9fc75ddb443c6f7c","observation_id":"7625dc85-0b40-4930-98b1-aadec5531b1a","resolution":{"observed_at":"2026-08-08T14:47:44.430073Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.075809Z","title":"In ESEC/FSE ’20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020","venue":null,"work_id":"493bb1f2-f441-43e8-bd48-17a781da2ef5","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.958678Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:c54f0ea6d08421f92e7da1d4c10cbcb021c0ab217a161a3e2e421a5e3cb15103","observation_id":"114013b8-e260-4fc8-b358-562f8b51c935","resolution":{"observed_at":"2026-08-08T14:47:44.084477Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.894628Z","title":"In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, Genoa, Italy, September 7-11, 2020","venue":null,"work_id":"9b65e3bf-58be-4200-84b6-29190873f230","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.961967Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5929c49c34f4102375af6d039f514356650d7e3ce0f879b391fda2ec6fccfd48","observation_id":"0b461f4e-83ef-47a7-967e-f84d35bbfd39","resolution":{"observed_at":"2026-08-08T14:47:43.898709Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.728940Z","title":"In MSR ’20: 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea, 29-30 June, 2020","venue":null,"work_id":"d1d562f2-9385-4597-be76-bc9cd4f02c9f","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.965332Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ffd39cd897e3105f0afe67d80cc5232279eef4cb12da07d254b8aabc4704f4f1","observation_id":"bf12e4f3-80f7-409d-afb9-a7405b56cd2d","resolution":{"observed_at":"2026-08-08T14:47:44.735239Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.650207Z","title":"IEEE Trans","venue":null,"work_id":"7f4ca44d-e8b6-43c3-84fc-5eca707021d3","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.968857Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b613a0d0a965d5a088c9e18b7636420c6305ff3370c731ceddb7389963e3f06c","observation_id":"e11501fe-1609-43ed-b9b8-c59a29e2d30a","resolution":{"observed_at":"2026-08-08T14:47:43.656697Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.474084Z","title":"In ICSE ’20: 42nd International Conference on Software Engineering, Seoul, South Korea, 27 June - 19 July, 2020","venue":null,"work_id":"838e373a-a864-43a8-baba-e806a3900710","year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.972039Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5fb67faca0139db0124d3ef1de01c4a0cb9c7c145a6977877a18a580da54ce2e","observation_id":"a2ff3e98-a8bd-42cb-81c0-7e5640567a1e","resolution":{"observed_at":"2026-08-08T14:47:43.478468Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.254565Z","title":null,"venue":null,"work_id":"12955be4-9fe8-41a9-9315-daf27d8e2448","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.975151Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:80bf5ff0ed361b84316f1047715f4ab93722e66d3c1722db46044b6a6feae428","observation_id":"b6217755-a72f-4165-93aa-b93b17558a9a","resolution":{"observed_at":"2026-08-08T14:47:44.257906Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.971313Z","title":"Retrieved May 23, 2024 from https://www.hyrumslaw.com/ Jiadong Xie, Fan Zhang, Kai Wang, Xuemin Lin, and Wenjie Zhang","venue":null,"work_id":"1a128940-127e-4027-8c35-2d5ab5b468a3","year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.978367Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:acabf3b8e3c890af88d942d68abbb8620ff5b73c3a10083106f5aca343d5d9a1","observation_id":"0bbbf1d8-6a27-4014-b48b-1d1d7542547c","resolution":{"observed_at":"2026-08-08T14:47:46.975874Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.308835Z","title":"In 39th IEEE International Conference on Data Engineering, ICDE 2023, Anaheim, CA, USA, April 3-7, 2023","venue":null,"work_id":"f02dddf8-386e-4fd0-bf09-60fbf6bf9405","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.981775Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:912ebe3508367939146eff679cacc89796f73acf66d100c530cdee5e1f7c50e2","observation_id":"d5427762-551f-425c-992d-b31e3c146387","resolution":{"observed_at":"2026-08-08T14:47:43.315430Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:43.141483Z","title":"In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023, Luxembourg, September 11-15, 2023","venue":null,"work_id":"7b7acf1b-c8e0-464f-b22b-15a9c0e597eb","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.985430Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:82470993b7069c06fab944159e6e55a7f2935aeba36efd7378363b82e943e25b","observation_id":"df452be6-2c84-4205-9291-1dc05896eed5","resolution":{"observed_at":"2026-08-08T14:47:43.157126Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.931073Z","title":"In Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy, CODASPY 2016, New Orleans, LA, USA, March 9-11, 2016","venue":null,"work_id":"0db050e8-b447-4292-bfc3-105308ea7ff1","year":2016},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.988982Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:8c545a21aae5ce6f8428d6bafba64bd7381bd9c51be159d1ab4d740fb8f62c81","observation_id":"b9117aa3-3e2a-4f98-a114-0cf8430d0427","resolution":{"observed_at":"2026-08-08T14:47:42.941204Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12196","last_updated":"2025-01-06T16:29:32Z","snapshot_observed_at":"2026-08-10T12:15:21.272271Z","submitted_at":"2024-03-18T19:10:12Z","title":"Leveraging Large Language Models to Detect npm Malicious Packages","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12196","snapshot_observed_at":"2026-08-08T14:47:41.992065Z","title":"CoRR abs/2403.12196 (2024)","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.992065Z"},"links":{"cited_paper":"/paper/2403.12196","citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4ef1dc6961b12bbe4969c3ddb1da9bfd20f937ada8aa66944ff58f33f6632f72","observation_id":"056bbb45-f0e1-450c-9399-e4b0d788acf1","resolution":{"observed_at":"2026-08-08T14:47:41.992065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.650055Z","title":"https://doi.org/10.1109/ICSE-SEIP58684.2023.00032 Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Bihuan Chen, and Yang Liu","venue":null,"work_id":"25856208-a753-4c75-8ccd-190f14c6282a","year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.995901Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:94a1a0f5e657d8fd918eab5dc926060ddf45e1f0aaa7ffd6bd1967ec5f7e528b","observation_id":"05e9111e-1a26-4492-97f5-b78a56c245c6","resolution":{"observed_at":"2026-08-08T14:47:42.697912Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:42.453521Z","title":"In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022","venue":null,"work_id":"4cac177e-f34c-4b51-a6ed-df1bf0399c6a","year":2022},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.999041Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:39b89efb823ae61fb19191c5c83ad234e1cb1e28659bd34ddaf3ce2ab7855fd3","observation_id":"b814acef-2772-4a1c-a439-1eb01d565b3d","resolution":{"observed_at":"2026-08-08T14:47:42.478014Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:46.958274Z","title":"In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019","venue":null,"work_id":"29b5e80c-027a-4920-a372-f7bdf99d1eca","year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:42.002141Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:ccbabeb87bc17894bc1c0ae32e41090859f5f852a97a5cff4b77124d95b8be5a","observation_id":"c08318a9-3ab5-4d4c-9ec0-b98ddc92ec42","resolution":{"observed_at":"2026-08-08T14:47:46.963815Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.4230/lipics.ecoop.2018.7","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T05:30:23.456663Z","title":"https: //doi.org/10.4230/LIPICS.ECOOP.2018.7 Courtney Miller, Christian Kästner, and Bogdan Vasilescu","venue":"DROPS (Schloss Dagstuhl – Leibniz Center for Informatics)","work_id":"e2dd6fd1-b33d-4e83-a43e-0dbd9fb0dc6e","year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":109,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.857721Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4c1945b203bc9001ce4b6791d352f9ccd06edbd55060525afce2bd4af8c59253","observation_id":"558903fa-0957-42cf-ac35-873077824b37","resolution":{"observed_at":"2026-08-08T14:47:42.085638Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1037/a0017543","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T05:30:23.456663Z","title":null,"venue":"Psychology and Aging","work_id":"6914053d-60cd-478c-ae59-b3258ccfc23e","year":null},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":477,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.758764Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:4b99d887f3952c9fb77f5545e1c48efaea1e7099705ecd7ada8f9a17d287e7a7","observation_id":"252a3ad4-1c5c-4f3c-8cdb-a8e58ec46650","resolution":{"observed_at":"2026-08-08T14:47:42.172227Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.067776Z","title":"Science 236, 4799 (1987), 280–285","venue":null,"work_id":"4638db50-c2f9-4847-8dc1-8d8f8816210f","year":1987},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":1987,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.924413Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:f857e019ad3b4435351b6a2de408250803189ddec5f1847e7848f94128ea6c77","observation_id":"586df582-df71-4d6b-91ed-2fb959958ab8","resolution":{"observed_at":"2026-08-08T14:47:47.072012Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.713137Z","title":"Archives of Internal Medicine 159, 17 (1999), 2070–2076","venue":null,"work_id":null,"year":1999},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":1999,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.713137Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:67acab657e2713ef2402c2397e5b8b6b84217ace215cf831e07afa4c5fce4d61","observation_id":"bbe84ed5-f4c3-42a5-9a0d-de0b5a215c32","resolution":{"observed_at":"2026-08-08T14:47:41.713137Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.846000Z","title":"In 21st IEEE/ACM International Conference on Automated Software Engineering (ASE 2006), 18-22 September 2006, Tokyo, Japan","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2006,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.846000Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:03a130fa1ad4bbdbf6f90264180b83bd0e9a5855f74c40b0eb1fcb5441e28a49","observation_id":"63c8971e-d38b-402e-b86f-d26698db6e37","resolution":{"observed_at":"2026-08-08T14:47:41.846000Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.293872Z","title":"Psychology and Aging 25, 2 (2010),","venue":null,"work_id":"77b9bae5-7933-47fe-919d-9cc682e8cebe","year":2010},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2010,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.754913Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:420927d49e64f6d040dec3f4cdb675de68706d923436207057acc6c282c770f4","observation_id":"cda830f3-f9b2-49a0-82fa-6febecbc2b77","resolution":{"observed_at":"2026-08-08T14:47:47.298202Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:47.079970Z","title":"Frontiers in Psychology 3 (2012),","venue":null,"work_id":"20a37c31-9531-47c6-a990-8ed2e09f570c","year":2012},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2012,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.917788Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:48740c9009fa37f328c97da7012ef7756329b9fc50f08556892f5cf76a9428ca","observation_id":"7dae9ad3-694c-407f-bf9b-5cc036491e74","resolution":{"observed_at":"2026-08-08T14:47:47.084212Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:44.889467Z","title":"In 36th International Conference on Software Engineering, ICSE ’14, Hyderabad, India - May 31 - June 07, 2014","venue":null,"work_id":"6b1ebf7b-e4d6-4449-b6e5-b58bb6346726","year":2014},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2014,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.921185Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:78603d5a29f02d6c4d46a1a7420301348e640ce651d328a36ffd17c90e1c1957","observation_id":"de336b92-c7d1-476c-8e19-4ef4f2c0c64a","resolution":{"observed_at":"2026-08-08T14:47:44.892694Z","resolver_source":"arxiv_id_nonexistent","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.685197Z","title":"The Sage Handbook of Regression Analysis and Causal Inference 327 (2015),","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2015,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.685197Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:73cb23675bf07b71faa98cfb571d3cab89da8ea3cf430406e461c174e08102db","observation_id":"c34ad358-91e1-4bd9-a589-512c8547face","resolution":{"observed_at":"2026-08-08T14:47:41.685197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.740220Z","title":"The Unseen Labor Behind our Digital Infrastructure (2016)","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2016,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.740220Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:d1e668e447e1445d32460666a4404c07e00148459f22219695d2332df606684a","observation_id":"e42569f0-f8db-46fb-8da1-c74d39b2ddf2","resolution":{"observed_at":"2026-08-08T14:47:41.740220Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.661302Z","title":"In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, Paderborn, Germany, September 4-8, 2017","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2017,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.661302Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:bc9ea4160b1016e44ea883a496227c4d7fa21c9a6585ccbe5707ea199f478439","observation_id":"e7f58e59-cc9c-4948-8db3-2e69aa13db85","resolution":{"observed_at":"2026-08-08T14:47:41.661302Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.729021Z","title":"In Proceedings of the 15th International Conference on Mining Software Repositories, MSR 2018, Gothenburg, Sweden, May 28-29, 2018","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2018,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.729021Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5cbc242bd76b3e1160e7417d9a5a34b2988b2ee49107cf33b8decd71fc289bd1","observation_id":"5d6d20eb-f887-4f55-8b34-b721f2052300","resolution":{"observed_at":"2026-08-08T14:47:41.729021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.732395Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2019,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.732395Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:88ce90bac4c332a42f3087d31f565525707d31617005621a6b1aa748530b09d5","observation_id":"303557ed-a2e3-4dec-b975-a8b1323319c1","resolution":{"observed_at":"2026-08-08T14:47:41.732395Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.656241Z","title":"In 27th IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2020, London, ON, Canada, February 18-21, 2020","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2020,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.656241Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3d902d7eacdadddaa6d60e109b50a612df26b1d05233a057e05d42990fd3a109","observation_id":"6143d244-fde8-4851-a8de-f1eb1744d77d","resolution":{"observed_at":"2026-08-08T14:47:41.656241Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.667102Z","title":"In 18th IEEE/ACM International Conference on Mining Software Repositories, MSR 2021, Madrid, Spain, May 17-19,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2021,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.667102Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:b94237223ed2b582590b3ff91d6a74edb932084fe5e96975d55911065bea9b33","observation_id":"ea7ebf12-fe2b-4eb4-be2b-5db539f10c4f","resolution":{"observed_at":"2026-08-08T14:47:41.667102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.680448Z","title":"Feelings","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.680448Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:3c1e6c9fd86e124ae934d50e3f3f4835419a04ba04c847c16f9ee8f01a4dff79","observation_id":"9af679c5-9316-4702-8a64-3b5ad268296b","resolution":{"observed_at":"2026-08-08T14:47:41.680448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.689531Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.689531Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:5c8d538ad9d736299d4ab89ca7a604cb9a321974813b6a92bfeea8a47b34b02b","observation_id":"fafbb455-9c60-4d5a-8bb5-a6ec13b7bf51","resolution":{"observed_at":"2026-08-08T14:47:41.689531Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T14:47:41.709273Z","title":"Retrieved April 28, 2024 from https://cran.r- project.org/web/packages/plm John R Crouse, Timothy Morgan, James G Terry, Julie Ellis, Mara Vitolins, and Gregory L Burke","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-08T14:47:41.709273Z"},"links":{"citing_paper":"/paper/2502.06662"},"observation_digest":"sha256:29beb6968b027066264d6ab44719baf6a969f0325319f0080a58c8ebf1b1da78","observation_id":"38a58db0-2da1-4156-bd8e-17f2044f81f5","resolution":{"observed_at":"2026-08-08T14:47:41.709273Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks"},"reference_resolution":{"displayed":92,"state_counts":{"malformed_identifier":1,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":40,"verified_exact":23,"verified_fuzzy":26},"total_outbound_references":92},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 92 of 92 outbound references and 2 inbound Pith citation observations for arXiv:2502.06662."}