Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
- Sequence
- #4
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457588985
- Off-chain at
- 2026-10-16T09:33:41.914Z
- Anchored at
- 2026-10-16T09:34:02.821Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 98AgtJJABQFcEH9ZyJBCSkbU1fVSiim2sD4cSPaBZ4aJ
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2181 chars)
{"actor":"reviewer","artifact_identity":"8337df2d80ab4d9de00effdebdca84c0","decided_at":"2026-10-16T09:33:41.658Z","decision":"review","disputed_pct":0.2941,"findings_hash":"13CRhMNsspt5sLKAHb2u6SrLCZ9Hd4ou7vrgKW1j1Z9u","investigation_id":"e46c6ad3-be50-48db-a6a5-50ede5b6a7ef","mode":"findings_only","new_score":0,"page_content_hash":"be36ac3310704a52faa77b6aca4c90750dc4d753f7b1210120fc6bd071af783c","page_slug":"mastra-ai-npm-supply-chain-attack-june-2026","prev_score":0,"reason":"The page's core narrative — a hijacked dormant 'ehindero' npm account republishing 140+ @mastra packages with a typosquatted 'easy-day-js' dependency carrying a multi-stage credential-stealing RAT between 01:12 and 02:39 UTC on June 17, 2026 — is well supported by the cited vendor blogs (StepSecurity, Snyk, Endor Labs, Phoenix Security, Orca Security), down to granular technical details like dropper byte size, obfuscation parameters, and the 166-extension wallet target list. The most significant problem is in the Threat Actor Attribution section: it frames attribution as unconfirmed by quoting Snyk, but omits that Microsoft's own cited blog post was updated on June 19, 2026 to assess with high confidence that the campaign is attributable to Sapphire Sleet (BlueNoroff) — a material omission from a source already in the page's citation list. There is also an internal contradiction between two sections over where the malware's beacon marker files were written (temp directory vs. home directory), and the page juxtaposes a weekly download figure and a monthly download figure in the same sentence that are not mathematically consistent with one another, suggesting they were drawn from different methodologies without disclosure. A handful of remediation details (the 'token bypass authentication' fix, the Hostwinds/AS54290 attribution for the C2 IP) could not be verified against the specific sources cited. The page has no coverage of actual victim losses or on-chain fund tracing, which is a notable gap for a crypto-focused investigation.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}