{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:QHJKS6ISYFM54I2ABWJ6RWXTAT","short_pith_number":"pith:QHJKS6IS","canonical_record":{"source":{"id":"2305.19760","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-05-31T11:45:43Z","cross_cats_sorted":["cs.PL"],"title_canon_sha256":"f29f84aa12258ff194b7d33511244ca99a9a7571edbe3b903159d9a0f462e5ca","abstract_canon_sha256":"d8982e6f0d327014af275c1f548472499ded38b59437f0b238cf49fe9cb7cd6d"},"schema_version":"1.0"},"canonical_sha256":"81d2a97912c159de23400d93e8daf304ffddcda31a8e2715ade6f4bc5531df9f","source":{"kind":"arxiv","id":"2305.19760","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2305.19760","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"arxiv_version","alias_value":"2305.19760v1","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2305.19760","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_12","alias_value":"QHJKS6ISYFM5","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_16","alias_value":"QHJKS6ISYFM54I2A","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_8","alias_value":"QHJKS6IS","created_at":"2026-07-05T11:01:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:QHJKS6ISYFM54I2ABWJ6RWXTAT","target":"record","payload":{"canonical_record":{"source":{"id":"2305.19760","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-05-31T11:45:43Z","cross_cats_sorted":["cs.PL"],"title_canon_sha256":"f29f84aa12258ff194b7d33511244ca99a9a7571edbe3b903159d9a0f462e5ca","abstract_canon_sha256":"d8982e6f0d327014af275c1f548472499ded38b59437f0b238cf49fe9cb7cd6d"},"schema_version":"1.0"},"canonical_sha256":"81d2a97912c159de23400d93e8daf304ffddcda31a8e2715ade6f4bc5531df9f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:01:21.630953Z","signature_b64":"KzYBh4QnIkzXAgpWYwzhVYw8/cBIkwPlETAliunEd8n2OLnFl3fTKiZ8Q3YSZU2024BUKqNwoD2+zktVZZvFCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"81d2a97912c159de23400d93e8daf304ffddcda31a8e2715ade6f4bc5531df9f","last_reissued_at":"2026-07-05T11:01:21.630468Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:01:21.630468Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2305.19760","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:01:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"z0zP1Ghh77kreiIR4qGtYdIVlb6xp4xNV8Bfg8AbE8rEXeTNNTv2kaHohmwzGGAuh7QWG9s1pp2ANLsh1uzvBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T05:59:13.635604Z"},"content_sha256":"befdfc46ccb021332c9009c994ceef83940518574e57fe9f9146f279b03d7265","schema_version":"1.0","event_id":"sha256:befdfc46ccb021332c9009c994ceef83940518574e57fe9f9146f279b03d7265"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:QHJKS6ISYFM54I2ABWJ6RWXTAT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"You Can Run But You Can't Hide: Runtime Protection Against Malicious Package Updates For Node.js","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.PL"],"primary_cat":"cs.CR","authors_text":"Felix Boes, Marc Ohm, Timo Pohl","submitted_at":"2023-05-31T11:45:43Z","abstract_excerpt":"Maliciously prepared software packages are an extensively leveraged weapon for software supply chain attacks. The detection of malicious packages is undoubtedly of high priority and many academic and commercial approaches have been developed. In the inevitable case of an attack, one needs resilience against malicious code. To this end, we present a runtime protection for Node.js that automatically limits a package's capabilities to an established minimum. The detection of required capabilities as well as their enforcement at runtime has been implemented and evaluated against known malicious at"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2305.19760","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2305.19760/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:01:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+a1+CGiQXK0RuwKAS2uUi2M33qu9NzMII5OXmowh4qNhJT9zPWxusqq3uCCOTDFIRIccfb+ht03IY+XAOsF1DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T05:59:13.636583Z"},"content_sha256":"3967b686dff51376e8b3b511f4448cb9d2bce0559c8cec2ea06b6d446f4dad23","schema_version":"1.0","event_id":"sha256:3967b686dff51376e8b3b511f4448cb9d2bce0559c8cec2ea06b6d446f4dad23"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/bundle.json","state_url":"https://pith.science/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T05:59:13Z","links":{"resolver":"https://pith.science/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT","bundle":"https://pith.science/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/bundle.json","state":"https://pith.science/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QHJKS6ISYFM54I2ABWJ6RWXTAT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:QHJKS6ISYFM54I2ABWJ6RWXTAT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d8982e6f0d327014af275c1f548472499ded38b59437f0b238cf49fe9cb7cd6d","cross_cats_sorted":["cs.PL"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-05-31T11:45:43Z","title_canon_sha256":"f29f84aa12258ff194b7d33511244ca99a9a7571edbe3b903159d9a0f462e5ca"},"schema_version":"1.0","source":{"id":"2305.19760","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2305.19760","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"arxiv_version","alias_value":"2305.19760v1","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2305.19760","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_12","alias_value":"QHJKS6ISYFM5","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_16","alias_value":"QHJKS6ISYFM54I2A","created_at":"2026-07-05T11:01:21Z"},{"alias_kind":"pith_short_8","alias_value":"QHJKS6IS","created_at":"2026-07-05T11:01:21Z"}],"graph_snapshots":[{"event_id":"sha256:3967b686dff51376e8b3b511f4448cb9d2bce0559c8cec2ea06b6d446f4dad23","target":"graph","created_at":"2026-07-05T11:01:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2305.19760/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Maliciously prepared software packages are an extensively leveraged weapon for software supply chain attacks. The detection of malicious packages is undoubtedly of high priority and many academic and commercial approaches have been developed. In the inevitable case of an attack, one needs resilience against malicious code. To this end, we present a runtime protection for Node.js that automatically limits a package's capabilities to an established minimum. The detection of required capabilities as well as their enforcement at runtime has been implemented and evaluated against known malicious at","authors_text":"Felix Boes, Marc Ohm, Timo Pohl","cross_cats":["cs.PL"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-05-31T11:45:43Z","title":"You Can Run But You Can't Hide: Runtime Protection Against Malicious Package Updates For Node.js"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2305.19760","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:befdfc46ccb021332c9009c994ceef83940518574e57fe9f9146f279b03d7265","target":"record","created_at":"2026-07-05T11:01:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d8982e6f0d327014af275c1f548472499ded38b59437f0b238cf49fe9cb7cd6d","cross_cats_sorted":["cs.PL"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-05-31T11:45:43Z","title_canon_sha256":"f29f84aa12258ff194b7d33511244ca99a9a7571edbe3b903159d9a0f462e5ca"},"schema_version":"1.0","source":{"id":"2305.19760","kind":"arxiv","version":1}},"canonical_sha256":"81d2a97912c159de23400d93e8daf304ffddcda31a8e2715ade6f4bc5531df9f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"81d2a97912c159de23400d93e8daf304ffddcda31a8e2715ade6f4bc5531df9f","first_computed_at":"2026-07-05T11:01:21.630468Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:01:21.630468Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"KzYBh4QnIkzXAgpWYwzhVYw8/cBIkwPlETAliunEd8n2OLnFl3fTKiZ8Q3YSZU2024BUKqNwoD2+zktVZZvFCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:01:21.630953Z","signed_message":"canonical_sha256_bytes"},"source_id":"2305.19760","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:befdfc46ccb021332c9009c994ceef83940518574e57fe9f9146f279b03d7265","sha256:3967b686dff51376e8b3b511f4448cb9d2bce0559c8cec2ea06b6d446f4dad23"],"state_sha256":"f74b906665bed6939478f9596670f4990a98faa4e4d7205e2f883423add4cbde"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CzeY0CcuUF9zXkjupeo/S+LRiLabObv0zb55XTK3MmuOR1b7vWcultzwFDNh7GoYnp2CfX1lXpfy4BsL5gr1Aw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T05:59:13.645297Z","bundle_sha256":"2134ce7ae2fd26f0ab89c451aa4c26745f60f45ccd15a3aaf53b90056fc6c475"}}