{"as_of":"2026-08-14T11:39:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:8e165267e06dd070ff1eb72bc8bdc1eca982a0d8c3dd0ea9128ea675ee35d930","coverage":[{"denominator":32,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":32,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-26T01:27:13.772082Z","state":"measured"},{"denominator":32,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":32,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2606.26291/citation-record","integrity":"/paper/2606.26291/integrity","json":"/paper/2606.26291/citation-record.json","paper":"/paper/2606.26291"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:d7589867a619c605a442b740e8c158fb33cb5e345ed48659b5e0f2c33133c9d4","observation_id":"01da6446-458c-4d30-9c74-abd123f5747a","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"A Serverless and Go Journey – Evolution of the Capital One Credit Offers API","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:02638cf171a03c955a63684ad13583c64943e5c4e48cd8ba6f07271a7a766d07","observation_id":"2f4630b4-2c46-4ad7-ade6-31bee919e764","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Is Golang Still Growing? Go Language Popularity Trends in 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:1d40f6d346eaab8d98f372dd7ba1c16e24f36ad6612eb6553c4780e48c6437b4","observation_id":"00fd61ac-4f50-47f3-b80e-84e4de12de46","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:9119d6620cb569c4e09124cc00b81db24c8d90a4602db1efb121a5c37664ab5b","observation_id":"65467138-3897-43e2-a88a-a360cf1740b1","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"How to go from untrusted open source compo- nents to trusted artifacts","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:89ca8cbaee81d688552ae64cab78fb3b8be3df9199b3a460c6ddc366fa945d4b","observation_id":"263be669-8242-41f7-8072-f8bb585526a6","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"ENISA THREAT LAND- SCAPE FOR SUPPLY CHAIN ATTACKS","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:df43f92b7acfd330a6d8f6b2308341f9dcc3548e3e47976760e89036f931bf41","observation_id":"5994c2a6-308e-4141-b9a6-2bb7506ea7bc","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"State of the Software Supply Chain Report","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:989427a4569a2a412bbeed1f76187be838140ec595ceb03449848d681786479b","observation_id":"4c3c5f91-0bf0-4a19-9dc7-01893842e2bb","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Widespread Sup- ply Chain Compromise Impacting npm Ecosystem","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:fba204aab62fcb872ea6255a37901d9a3c34006e2425f79286d4bbcb9f3fe4a4","observation_id":"62d6e45a-c38e-484f-89ee-e558009d7c78","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"post/1805653","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T15:49:56.408451Z","title":"event-stream incident report","venue":null,"work_id":"1846bb56-1543-4a82-9256-5067612c19d0","year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:4b52c968636b50d00af824f626982f8cac47503d0738675e85be3b09f83968d5","observation_id":"b4f418a6-1193-4f9d-b296-99fede4f711f","resolution":{"observed_at":"2026-07-04T15:49:56.411014Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Compromised PyTorch-nightly dependency chain be- tween December 25th and December 30th, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:12d77a7c2131a00d5b7c8ca06fe10930270728759f462a928da86ee328f044a7","observation_id":"8d705ac8-e0df-4996-a690-36da1ffdf473","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Someone copied our GitHub project, made it look more trustworthy by adding stars from many fake users, and then injected malicious code at runtime for potential users","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:4dfa971fa192585d00943540175c854c5bcf7de61184d548d61d30cc4d78381d","observation_id":"db7c0f20-63eb-4d27-b444-ccb8389e9281","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Attacks on Maven Proxy Repositories","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:4b66ff360af5771ac480f16b15b2202c98a73665c5c5664f1635a0fb4ca0d132","observation_id":"c2e973f2-4d58-4fc2-93b0-b5622d9ac00c","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.13459","last_updated":"2025-09-06T18:12:10Z","snapshot_observed_at":"2026-08-11T13:04:28.675545Z","submitted_at":"2024-12-18T03:03:58Z","title":"Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware","version":2},"cited_work":{"arxiv_id":"2412.13459","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.13459","snapshot_observed_at":"2026-07-04T15:49:56.412360Z","title":"4.5 million (suspected) fake stars in github: A growing spiral of popularity contests, scams, and malware","venue":null,"work_id":"aa3e505e-623d-447d-88cf-871ce1db960b","year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"cited_paper":"/paper/2412.13459","citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:68b1388d3f0a24ff6669fb1e08e161e2bbee0a0f9bab853dddd05d7c041b273b","observation_id":"25a04594-c872-4ef8-b85f-77cf93ede95e","resolution":{"observed_at":"2026-07-04T15:49:56.414269Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"7228.342725","doi":"10.1145/3427228.3427258","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In: Proceedings of the 36th An- nual Computer Security Applications Conference (ACSAC ’20), pp","venue":"Annual Computer Security Applications Conference","work_id":"81fb84c7-7a56-43e9-a816-080f3dbc2e88","year":null},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:ae7d5b4d5184c391acd2a8469ec7f8b3a9bd768d0ab38e56b847436175abe5ac","observation_id":"ef371e49-6d1e-4463-877e-e453d686aa3a","resolution":{"observed_at":"2026-06-26T01:28:50.742734Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:e5c71c8cc341c209e1dca34e35ef20e13742be690c2a90d4dfc73d1b79cbc639","observation_id":"a4b54ffe-6d48-4d05-bd21-4a5047f41521","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Millions of Malicious Repositories Flood GitHub","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:d9cc01b38fd71b7b9eb786ed313bf1a75a26933c5da4f55902417629b0ee0595","observation_id":"ac6269f1-7fda-42ec-a9a5-b885e1047d14","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"GitHub Docs:Reporting abuse or spam.https://docs","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:b458dffe249a052b4c0b46b4d867caab6db17877be31490b27ff3712f706a3e8","observation_id":"d1b57b37-db69-4cb6-b2dd-529166b33777","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Over 100,000 Infected Repos Found on GitHub","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:d93b4b15183fe24a39344614b2c980699ec7058547b0d86d5239af5d0bc53a49","observation_id":"ee8394c7-96b6-425d-bb07-c1a69029735c","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Flash Report: GitHub Repositories Targeted in Mali- cious Cyber Activity","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:cc02fb54259e47f3abd45588f8421795707723a530a650cac9fa73b3471c8341","observation_id":"d3efdd12-4ef9-4e19-bdd2-257309f5e125","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:c12d36f8dbadf9f49f641ba81c45d6a0ea1dcdee68c7ca3c05afd06dbc062af1","observation_id":"fc67921a-4060-4e6d-b105-f86ab3311fba","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:addb1a240542e9a046913c1b5a5ca1664b5c33b7e732c964b4392098ad1c43bd","observation_id":"17f6208a-e837-41c9-9508-36d669d1ace2","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"Go Supply Chain Attack: Ma- licious Package Exploits Go Module Proxy Caching for Persis- tence","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:d2f4e4b2cf87e5fabea2549939afd863cdc6f8e7ea91df7d2ad7f93b22bb86b8","observation_id":"98a65fef-aa75-4dd6-abc4-b32dd73cb024","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"dev/blog/module-mirror-launch, last accessed 2026/04/10","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:02112dfb63b2bd2cdea5c7fa60805d81df06670b52c193eeefb498d88aab4537","observation_id":"ec14796b-3fe3-479c-b06a-cc93e70cc085","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:611f11849b3afd9ea39c190c846f061afdfa440c29ee951442a7a2266a1f59e1","observation_id":"e1b7ced1-d08e-492c-8c60-f221c159f391","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:c3937b8a460f6ebfdc8c602cc0964c3aba743cdcf07d2c787f1eff45cfe3e7e5","observation_id":"c0055760-ce73-441a-9fa2-499e6d328a86","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"1338.33614","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T15:49:56.396467Z","title":"In: 28th USENIX Security Symposium (USENIX Security ’19), pp","venue":null,"work_id":"dc969efb-9ddd-48f4-8c40-b9bf46cfbdfd","year":null},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:0ec2171ed2947339eaf0369f9f45dba41024b911c45351e8aa42677778383623","observation_id":"8392b7c6-84ca-4289-a5de-e4db2446da47","resolution":{"observed_at":"2026-07-04T15:49:56.398758Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2204.04008","last_updated":"2022-04-19T19:02:15Z","snapshot_observed_at":"2026-08-14T08:18:19.610402Z","submitted_at":"2022-04-08T11:37:24Z","title":"Taxonomy of Attacks on Open-Source Software Supply Chains","version":2},"cited_work":{"arxiv_id":"2204.04008","doi":"10.48550/arxiv.2204.04008","metadata_source":"arxiv_reference","pith_arxiv_id":"2204.04008","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In: IEEE Symposium on Security and Privacy (SP ’23), pp","venue":"arXiv (Cornell University)","work_id":"edc1c6bf-1798-43fe-b68c-68213e846549","year":2022},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"cited_paper":"/paper/2204.04008","citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:ef59fc59432a1afede24599243f1af60453c68f27a02753690b304bbd83593ad","observation_id":"a55e2d73-f277-43b5-9670-d1a1ca6e8348","resolution":{"observed_at":"2026-07-04T15:49:56.406200Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-06-26T01:27:13.772082Z","title":"In: Network and Distributed System Security (NDSS ’21) Symposium.https://www.ndss-symposium.org/wp-content/uploads/ndss2021_ 1B-1_23055_paper.pdf","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:58f21f895fc8d7584ddb80989c5ea2baceade8f55dad6f4a0d3ed8b0a62e9ce4","observation_id":"685d49c8-a169-4052-b1d3-a7abc7430d07","resolution":{"observed_at":"2026-06-26T01:27:13.772082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/978-3-030-52683-2_2","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"In: Proceedings of the 17th International Conference on Detection of Intrusions and Malware, and Vulnera- bility Assessment (DIMVA)","venue":"Lecture notes in computer science","work_id":"4f788715-991e-4444-9490-2d0199eeecce","year":2020},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:b9abde7707f8676a1b6bc483f96aa11cfc9fed4283998c37fc16a2b84239e896","observation_id":"639b6457-1f5b-4d7a-9f4f-5523f13134b5","resolution":{"observed_at":"2026-06-26T01:28:50.736511Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-05-21T19:52:28.529819+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-21T19:52:28.529819+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"9944.369616","doi":"10.1145/3689944.3696164","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InProceedings of the 2024 Workshop on Software Supply Chain Offen- sive Research and Ecosystem Defenses (SCORED ’24)","venue":null,"work_id":"713590a9-79e3-46df-9cfd-cddfe72a531e","year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:da1e1752a5c17bbac45f2c5ee065054d7ee11c461f09fe756f17d6875532c692","observation_id":"9e695e3f-93cc-43ed-8cc3-46cfc1193020","resolution":{"observed_at":"2026-06-26T01:28:50.745366Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.11016","last_updated":"2025-05-16T09:10:07Z","snapshot_observed_at":"2026-08-11T09:03:48.995593Z","submitted_at":"2025-05-16T09:10:07Z","title":"GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement","version":1},"cited_work":{"arxiv_id":"2505.11016","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.11016","snapshot_observed_at":"2026-07-04T15:49:56.401011Z","title":"arXiv preprint (2025)","venue":null,"work_id":"64d6fa64-9250-40ee-a751-f6f28d9bbefd","year":2025},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"cited_paper":"/paper/2505.11016","citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:209d20431532f39f7f43fe2f076ebd1b48d0eba4c2f529b9f60d4845b28d114e","observation_id":"581399a8-6cad-4cf9-8d5a-53be48e024d8","resolution":{"observed_at":"2026-07-04T15:49:56.402401Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"7503.363923","doi":"10.1145/3597503.3639230","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"An empirical study on low GPU utilization of deep learning jobs","venue":null,"work_id":"1abc9716-1187-4772-a86c-a86e9524eae8","year":2024},"citing_paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-06-26T01:27:13.772082Z"},"links":{"citing_paper":"/paper/2606.26291"},"observation_digest":"sha256:4b41e8923067f90e31a293ce20291b9ec3d1ccd4ed41d3c7afd9fa677540abcf","observation_id":"f10ef833-89c2-467a-87c4-e3e848cc355a","resolution":{"observed_at":"2026-06-26T01:28:50.739966Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2606.26291","last_updated":"2026-06-24T18:36:38Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T01:35:17.606927Z","submitted_at":"2026-06-24T18:36:38Z","title":"Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild"},"reference_resolution":{"displayed":32,"state_counts":{"malformed_identifier":0,"metadata_mismatch":3,"parse_uncertain":0,"unresolved":23,"verified_exact":6,"verified_fuzzy":0},"total_outbound_references":32},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 32 of 32 outbound references and 0 inbound Pith citation observations for arXiv:2606.26291."}