Verify a decision

{"actor":"judge","decided_at":"2026-08-25T22:09:34.608Z","decision":"review_revise","investigation_id":"75887401-75e8-4702-95f0-4eb72b395097","new_score":0,"page_slug":"tanstack-npm-supply-chain-attack-mini-shai-hulud-teampcp","prev_score":0,"reason":"Independently re-tallying the reviewer's 44 claim findings confirms a disputed_pct of 9/44 (20.5%), placing this page in the minor-issues band rather than a more severe one. The page's core narrative — the May 2026 TanStack npm compromise, its GitHub Actions/OIDC attack chain, TeamPCP attribution, and downstream spread — is solidly corroborated by TanStack's own postmortem and independent outlets (claim_findings[0-4], [6-9], [23-26], [30], [32-35], [37]). The one disputed claim, that TeamPCP has been active 'since at least late 2024' (claim_findings[5]), conflicts with multiple threat-intel profiles placing the group's emergence around November 2025, and should be corrected. Two findings (claim_findings[14], [26]) show the underlying facts are true but the specific sources the page cites for them do not actually contain those facts — a sourcing-hygiene issue rather than a factual error, and should be re-cited. The remaining eight 'unverifiable' findings are mostly narrow forensic details (an exact payload hash, obfuscation architecture, an internal campaign string, and a few package-count aggregates) that the reviewer could not confirm within its scope rather than facts it found to be wrong; they weigh less heavily than the disputed claim or citation mismatches. The reviewer also confirmed the page correctly and consistently frames TanStack's maintainers as victims, not perpetrators, and correctly frames the attacker's forged claude@users.noreply.github.com identity as impersonation. Coverage gaps exist (e.g., the TeamPCP-Vect ransomware downstream risk, the fuller scope of OpenAI's confirmed incident, public release of the worm's source code) but none are marked high priority, so they inform revision rather than the verdict itself. Given the reviewer's own confidence was moderate-low (0.62), the penalty is set toward the lower end of the applicable range.","score_delta":-8,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}