Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review_revise · Mastra AI npm Supply Chain Attack (June 2026)
- Sequence
- #6
- Score
- 0 → 0 (-20)
- Cluster
- mainnet-beta
- Slot
- 464263458
- Off-chain at
- 2026-11-01T22:40:25.655Z
- Anchored at
- 2026-11-01T22:40:35.000Z
- Block time
- 2026-11-01T22:40:35.000Z
Independent verification
- 1. Database (off-chain)
- A7rW71PHxrLga5tnQUrfBrXpavBPWgqSn115zK5Xz4o
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2165 chars)
{"actor":"judge","artifact_identity":"543006dbd5aba276e103bb6463b06282","band_override":null,"decided_at":"2026-11-01T22:40:25.345Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3,"investigation_id":"e46c6ad3-be50-48db-a6a5-50ede5b6a7ef","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"mastra-ai-npm-supply-chain-attack-june-2026","prev_score":0,"reason":"Most of the page's technical record (account takeover, payload, response timeline, package counts) matches Microsoft, StepSecurity, Snyk and Mastra's official incident report. However, the page says attribution is unconfirmed and that no threat-intelligence firm has attributed the attack (claim_findings[0] stale, claim_findings[1] disputed), while Microsoft, a cited Tier 1 source, assessed with high confidence on June 19, 2026 that it is Sapphire Sleet activity; omission_findings[0] records that this is missing. A timing claim of 26 minutes conflicts with the page's own times of 01:01 and 01:12 UTC, which give 11 minutes (claim_findings[2]), and one version detail could not be confirmed (claim_findings[6]). A second material omission, Microsoft's reported Windows follow-on compromise (omission_findings[1]), is also missing from the remediation and IOC sections. Mastra continues to operate and the incident was remediated, so the page needs correction rather than delisting.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-20,"sequence_num":6,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"The raw percentage (3 of 10 findings disputed or unverifiable, 30%) sits at the minor/significant boundary, and the disputed findings concern the page's core attribution question. A material omission (Microsoft's high-confidence Sapphire Sleet attribution of June 19, 2026) and a stale summary claim on the same point mean the percentage understates the problem, so the page is judged in the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}