Verify a decision

{"actor":"judge","decided_at":"2026-08-27T06:05:37.378Z","decision":"review_approve","investigation_id":"7fcf4c4e-798e-4496-9187-53a8ab811cf1","new_score":62,"page_slug":"injective-npm-sdk-supply-chain-attack","prev_score":62,"reason":"The review found no disputed or unverifiable claims among 28 tested (disputed_pct = 0/28 = 0.0%), and this was independently recomputed rather than taken on faith. The reviewer specifically tested, and confirmed with named primary sources, the things most likely to be wrong on a page of this type: that the incident is correctly classified as a compromised-maintainer npm publish rather than a protocol-level exploit (claim_findings[4], [5]), that the propagation to 17 additional packages is correctly attributed to pinned-dependency mechanics rather than a self-propagating worm (claim_findings[11]), that no unsupported threat-actor attribution appears on the page, and that the core account -- date, package/version numbers, the ~49-minute exposure window, detection credited to Socket/Ox Security/StepSecurity, the Eric Chen 'no funds at risk' quote, and the absence of confirmed losses -- is verbatim-corroborated against primary vendor writeups such as StepSecurity and Datadog (claim_findings[0], [2], [3], [14]-[16], [18], [20]). All six cited URLs were confirmed live. Three claims were only partially supported (claim_findings[13], [17], [19]), and notably all three imprecisions run in the same direction, making the incident look smaller or better-handled than sources establish: a cumulative all-time download total is presented as a weekly rate and used as the denominator for a reassuring 'small fraction' comparison, an account-access revocation is asserted beyond what the cited primary source states, and an unsourced claim attributes suspicious downloads to bots or scanners. Even treating the weekly-rate mischaracterization as a disputed claim rather than partially supported -- which is arguably the more defensible read, since it is load-bearing for a minimizing conclusion rather than merely incomplete -- the disputed_pct rises only to 3.6% (1/28), still comfortably inside the 0-10% approve band. Coverage gaps are medium (no GHSA/npm advisory or Injective-authored post-mortem) and low priority only, so the high-priority escalation rule is not engaged, and a clean accepted_submissions result reflects a successful empty query rather than an inaccessible database. The page is approved as published; the reassuring-imprecision pattern should be corrected editorially but does not meet the bar for a score penalty or status change.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}