Verify a decision

{"actor":"judge","decided_at":"2026-08-25T22:39:18.561Z","decision":"review_revise","investigation_id":"e46c6ad3-be50-48db-a6a5-50ede5b6a7ef","new_score":0,"page_slug":"mastra-ai-npm-supply-chain-attack-june-2026","prev_score":0,"reason":"Of the 24 claims the reviewer actually checked (the reviewer's own summary totals are miscounted and were disregarded), 19 were confirmed, 2 partially supported, 1 disputed, and 2 unverifiable, putting disputed+unverifiable at 12.5% of claims -- solidly in the minor-issues band. The one disputed finding (claim_findings[13], Threat Actor Attribution) is notable because it runs opposite to the typical failure mode on this platform: the page hedges on North Korea-linked group Sapphire Sleet/BlueNoroff as only an unconfirmed 'tradecraft overlap,' even though the page's own highest-credibility cited source -- a Microsoft security blog post titled specifically for this incident -- states high-confidence attribution, echoed without hedging by other outlets the page also cites. This is a real accuracy defect (the page should reconcile its framing with its own sourcing) but it understates rather than overstates a risk factor and does not shift blame onto or away from Mastra or its maintainers, who are accurately and consistently described as victims of credential theft throughout (verified). The two unverifiable items -- an uncited claim that Mastra is 'widely used' in DeFi/blockchain pipelines, and a precise but unsupported 2024-01-01 timeline date that even conflicts with the page's own body text -- are minor and additive rather than central. No link rot was found across ten sampled citations, and the page correctly avoids conflating this incident with the separate April 2026 campaign.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}