Paper Citation Record · LEDGER

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?

As of 22 August 2026, this Paper Citation Record lists 42 of 42 outbound references and 2 inbound Pith citation observations for arXiv:2504.13769.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2504.13769 v1

Coverage vector

measured 42 of 42 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-08-16T12:03:43.361305Z

measured 44 of 44 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-22T06:32:14.747728+00:00

measured 2 of 2 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links, observed 2026-08-05T23:03:25.790976Z

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: arxiv_reference, observed 2026-07-02T19:07:18.276390Z

Reference resolution

42 of 42 outbound references displayed

verified exact2
verified fuzzy2
unresolved37
parse uncertain0
malformed identifier1
metadata mismatch0

External citation measurements

No source-named external measurement is stored.

Outbound references

Observation a2c2100c-0f81-4db4-8c73-d1b8dd26eed0 · outbound

This paper cites Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?

Reference 1

Resolution: verified fuzzy; raw_fallback, observed 2026-08-16T12:03:44.621762Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 4dbf9cdf-b92d-4258-add1-df7bfef91b08 · outbound

This paper cites Tuck, Rakesh M.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Tuck, Rakesh M

Reference 2

Resolution: verified fuzzy; raw_fallback, observed 2026-08-16T12:03:44.605351Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 6883c057-5ff1-467b-b48e-c2ce447ea7db · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 3

Resolution: malformed identifier; no resolver link, observed 2026-08-16T12:03:43.185243Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3945f105-4ada-4177-900c-ad1e3b1e3cf9 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 4

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.590676Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 14c0ba75-ee57-4980-bc99-ee4e54017564 · outbound

This paper cites Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG

Reference 5

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.195091Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 78db0ede-c935-4cef-81ee-e5eaa67af947 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 6

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.200159Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 470a0802-6d4f-41c4-b816-d09484620d80 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 7

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.576583Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 380b67ff-e855-47b3-bde6-a75a2a1ecab7 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 8

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.560260Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation f986953e-33a4-4edf-9d28-d3e80a7b840f · outbound

This paper cites Retrieval-Augmented Generation for Large Language Models: A Survey.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Retrieval-Augmented Generation for Large Language Models: A Survey

Reference 9

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.214615Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c857eddc-b52d-4a5e-b9c5-9ef173207aa8 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 10

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.544685Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 7ab321c8-f04a-4ced-b28a-b1530d8e4046 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 11

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.225114Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation dc595a1b-1618-4bcf-879c-c66540a5251c · outbound

This paper cites PenHeal: A Two-Stage LLM Framework for Automated Pentesting and Optimal Remediation.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? PenHeal: A Two-Stage LLM Framework for Automated Pentesting and Optimal Remediation

Reference 12

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.233878Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c237c161-9431-4e1c-9754-752623fe1ac8 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 13

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.238494Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3a16a6b8-f9c1-49ca-818f-78d93c5a4d0a · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 14

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.242900Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation a752230b-8747-411e-82d0-75ccfb77d500 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 15

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.247181Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 2e29aebc-f00d-45ad-8fef-7f7ccdbdac7e · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 16

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.251651Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 07e45e34-e839-41ac-a355-b68a36d8cc61 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 17

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.518964Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 7782b752-4328-433b-a2b6-b12465768bf4 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 18

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.259590Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 08bdddf0-2417-476c-b91b-9fb405e96a7e · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 19

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.263730Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 4380b793-f7dc-4342-b8cd-4fa307002940 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 20

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.268547Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f8b18901-a58a-4084-b5d0-485238726e76 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 21

Resolution: verified exact; raw_fallback, observed 2026-08-16T12:03:43.758920Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 11288890-7bb0-4831-a686-7b0f4afa6e35 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 22

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.493710Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation a42624ca-7677-42d0-845f-a4f03166b004 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 23

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.478508Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation f261f430-e003-41af-a328-0e5b31fca751 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 24

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.286997Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3b0ef55b-468c-446b-b997-58acfaff1387 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 25

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.463290Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 46e0b73f-f26e-463a-98e7-51c292d33e92 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 26

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.296219Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 98b0ea0b-c936-45f5-b381-f6482304eeb5 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 27

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.300827Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation fa29c9cc-478d-4969-ad15-0578a43555e3 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 28

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.437991Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 099e4967-df9a-40f1-942f-6ebf0df9f0f1 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 29

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.423048Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 06acb16c-9b14-44a0-b81d-783efb3710ca · outbound

This paper cites LProtector: An LLM-driven Vulnerability Detection System.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? LProtector: An LLM-driven Vulnerability Detection System

Reference 30

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.305327Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 43c4cb7d-ebc7-4f04-bb58-45f780b15b5f · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 31

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.323736Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3a69cf27-2fca-4478-9e70-7407a4cc58dd · outbound

This paper cites Corrective Retrieval Augmented Generation.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Corrective Retrieval Augmented Generation

Reference 32

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.333557Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8511fe2e-a669-47bc-b9a6-828c81945d49 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 33

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.407567Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 7400c0e3-0104-434e-93a1-334c44e4446d · outbound

This paper cites Retrieval Augmented Generation Integrated Large Language Models in Smart Contract Vulnerability Detection.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Retrieval Augmented Generation Integrated Large Language Models in Smart Contract Vulnerability Detection

Reference 34

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.343286Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation a5f16204-07ad-4ba7-bfa7-c55ab313118c · outbound

This paper cites A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems

Reference 35

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.328494Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 848ec1b0-63cc-4313-8b3b-e97d3175c06f · outbound

This paper cites Leveraging Large Language Models to Detect npm Malicious Packages.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Leveraging Large Language Models to Detect npm Malicious Packages

Reference 36

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.352325Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 9d81cb4f-797e-448e-bead-cc1b0c7c8568 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 37

Resolution: unresolved; raw_fallback, observed 2026-08-16T12:03:44.381794Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation ae41dd89-2674-4ab2-a0c7-66849363a766 · outbound

This paper cites Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence

Reference 38

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.361305Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 109218cb-ca28-4f27-95d1-1b2ae5348463 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 39

Resolution: verified exact; raw_fallback, observed 2026-08-16T12:03:43.579533Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 8682a396-68fc-44a0-8ff5-e63cfe54eb69 · outbound

This paper cites an unresolved cited work.

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? Unresolved cited work

Reference 41

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.356902Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 302f2cc5-8928-4cc1-a9b0-95cd79bf5fe3 · outbound

This paper cites In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE).

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)

Reference 2023

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.229771Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 66554157-dbc2-4a56-b4ef-da837e67c8e5 · outbound

This paper cites In Proceedings of the 10th ACM International Workshop on Security and Privacy Analytics (Porto, Portugal) (IWSPA ’24).

Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? In Proceedings of the 10th ACM International Workshop on Security and Privacy Analytics (Porto, Portugal) (IWSPA ’24)

Reference 2024

Resolution: unresolved; no resolver link, observed 2026-08-16T12:03:43.180505Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Pith citing papers

Observation 973e9801-4b7a-4d7f-9a82-01348c23ea30 · inbound

MOLOT System Card: Malicious Operational Logic Observation Transformer cites this paper.

MOLOT System Card: Malicious Operational Logic Observation Transformer Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?

Reference 9

Resolution: verified exact; arxiv_id, observed 2026-07-02T19:07:18.278059Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.

Observation 760af3f7-fa46-48c2-bea7-06939544f992 · inbound

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories cites this paper.

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?

Reference 23

Resolution: unresolved; no resolver link, observed 2026-08-05T23:03:25.790976Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.