{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:XPKUYQC4UPTHVYYBORZ6AXNYPM","short_pith_number":"pith:XPKUYQC4","canonical_record":{"source":{"id":"2606.07792","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-05T19:10:31Z","cross_cats_sorted":["cs.LG","cs.SE"],"title_canon_sha256":"d56ff824b3b4e23223af79c36c24949d42f9eaeae4d4ee256223c728816d5513","abstract_canon_sha256":"a0b4cbf5860cfa447bff5a9159c9294738971bfdac371dc99d79fc56481110c7"},"schema_version":"1.0"},"canonical_sha256":"bbd54c405ca3e67ae3017473e05db87b3c4e65b82370ee10f33e99ae2297e354","source":{"kind":"arxiv","id":"2606.07792","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.07792","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"arxiv_version","alias_value":"2606.07792v1","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.07792","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_12","alias_value":"XPKUYQC4UPTH","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_16","alias_value":"XPKUYQC4UPTHVYYB","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_8","alias_value":"XPKUYQC4","created_at":"2026-06-09T01:04:52Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:XPKUYQC4UPTHVYYBORZ6AXNYPM","target":"record","payload":{"canonical_record":{"source":{"id":"2606.07792","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-05T19:10:31Z","cross_cats_sorted":["cs.LG","cs.SE"],"title_canon_sha256":"d56ff824b3b4e23223af79c36c24949d42f9eaeae4d4ee256223c728816d5513","abstract_canon_sha256":"a0b4cbf5860cfa447bff5a9159c9294738971bfdac371dc99d79fc56481110c7"},"schema_version":"1.0"},"canonical_sha256":"bbd54c405ca3e67ae3017473e05db87b3c4e65b82370ee10f33e99ae2297e354","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-09T01:04:52.323778Z","signature_b64":"5rOV72+uw20ZZMvp0dNGS52x1weVKtErxVPglWhL8OTbGrLiAHAsNXV4uPZC3sqQXK9MalZldJO0NRug1d3YBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bbd54c405ca3e67ae3017473e05db87b3c4e65b82370ee10f33e99ae2297e354","last_reissued_at":"2026-06-09T01:04:52.323406Z","signature_status":"signed_v1","first_computed_at":"2026-06-09T01:04:52.323406Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.07792","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-09T01:04:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FMZqyxbw5ld1JewLwj4PwcE45Rqn0jW+IVuSvSP5ihVychjvgwEQKuxSvw4dA6D6VkdLLMyQTsFe49S5YjVqCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-29T15:20:46.030580Z"},"content_sha256":"66cbb0c3a9462331a2a78840e7d3871bbfec34c4997894032643239aa5e3504b","schema_version":"1.0","event_id":"sha256:66cbb0c3a9462331a2a78840e7d3871bbfec34c4997894032643239aa5e3504b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:XPKUYQC4UPTHVYYBORZ6AXNYPM","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"MOLOT System Card: Malicious Operational Logic Observation Transformer","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.LG","cs.SE"],"primary_cat":"cs.CR","authors_text":"Aleksandr Khalikov, Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky","submitted_at":"2026-06-05T19:10:31Z","abstract_excerpt":"MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraint"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.07792","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.07792/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-09T01:04:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/Dy7YJ3XXKhsraXQLktKfyGbwuXP6sb9lco7h8kU6XBpsK+bF+RNocb1/i2uLeSM3qGOi6o7bAqpbQvPxAdtDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-29T15:20:46.030953Z"},"content_sha256":"3c105b4e57637fbfcb3921116586ace448be476d2463065ddd34a7cb756d4feb","schema_version":"1.0","event_id":"sha256:3c105b4e57637fbfcb3921116586ace448be476d2463065ddd34a7cb756d4feb"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/bundle.json","state_url":"https://pith.science/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-29T15:20:46Z","links":{"resolver":"https://pith.science/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM","bundle":"https://pith.science/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/bundle.json","state":"https://pith.science/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XPKUYQC4UPTHVYYBORZ6AXNYPM/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:XPKUYQC4UPTHVYYBORZ6AXNYPM","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a0b4cbf5860cfa447bff5a9159c9294738971bfdac371dc99d79fc56481110c7","cross_cats_sorted":["cs.LG","cs.SE"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-05T19:10:31Z","title_canon_sha256":"d56ff824b3b4e23223af79c36c24949d42f9eaeae4d4ee256223c728816d5513"},"schema_version":"1.0","source":{"id":"2606.07792","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.07792","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"arxiv_version","alias_value":"2606.07792v1","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.07792","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_12","alias_value":"XPKUYQC4UPTH","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_16","alias_value":"XPKUYQC4UPTHVYYB","created_at":"2026-06-09T01:04:52Z"},{"alias_kind":"pith_short_8","alias_value":"XPKUYQC4","created_at":"2026-06-09T01:04:52Z"}],"graph_snapshots":[{"event_id":"sha256:3c105b4e57637fbfcb3921116586ace448be476d2463065ddd34a7cb756d4feb","target":"graph","created_at":"2026-06-09T01:04:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.07792/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraint","authors_text":"Aleksandr Khalikov, Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky","cross_cats":["cs.LG","cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-05T19:10:31Z","title":"MOLOT System Card: Malicious Operational Logic Observation Transformer"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.07792","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:66cbb0c3a9462331a2a78840e7d3871bbfec34c4997894032643239aa5e3504b","target":"record","created_at":"2026-06-09T01:04:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a0b4cbf5860cfa447bff5a9159c9294738971bfdac371dc99d79fc56481110c7","cross_cats_sorted":["cs.LG","cs.SE"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-05T19:10:31Z","title_canon_sha256":"d56ff824b3b4e23223af79c36c24949d42f9eaeae4d4ee256223c728816d5513"},"schema_version":"1.0","source":{"id":"2606.07792","kind":"arxiv","version":1}},"canonical_sha256":"bbd54c405ca3e67ae3017473e05db87b3c4e65b82370ee10f33e99ae2297e354","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bbd54c405ca3e67ae3017473e05db87b3c4e65b82370ee10f33e99ae2297e354","first_computed_at":"2026-06-09T01:04:52.323406Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-09T01:04:52.323406Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5rOV72+uw20ZZMvp0dNGS52x1weVKtErxVPglWhL8OTbGrLiAHAsNXV4uPZC3sqQXK9MalZldJO0NRug1d3YBQ==","signature_status":"signed_v1","signed_at":"2026-06-09T01:04:52.323778Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.07792","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:66cbb0c3a9462331a2a78840e7d3871bbfec34c4997894032643239aa5e3504b","sha256:3c105b4e57637fbfcb3921116586ace448be476d2463065ddd34a7cb756d4feb"],"state_sha256":"f24d4d731154c0f411b20801faf1985d295ec49624baa7647e37827a885b346e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tTYCvxpM0S9MUOU/PMOeJ/8bchjT/rS72lXpFYzft6E/pLbmvIofzfYZTtlYmqQgCUf9hXlPBPHhWXYbwtMDAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-29T15:20:46.032928Z","bundle_sha256":"54cde8d638f1553d158c50bc02f0a7b3eca33603ed60593ec5a9fcbe6645fa8c"}}