[AradTraub]

Renders the "Malicious package found" SCA policy (1fe6d83a-19de-48a2-a5ba-a80fe648489b) in scan output, and adds the scan option needed for the backend to run the detector at all.

Mirrors CM-68446 (unmaintained packages), which is the template for every file here.

Changes

File	Change
consts.py	MALICIOUS_PACKAGE_POLICY_ID
cli_types.py	ScaScanTypeOption.MALICIOUS_PACKAGES
scan_command.py	malicious-packages added to the --sca-scan default set
scan_parameters.py	malicious_packages wire parameter
sca_policy_details.py	Advisory + Remediation rows (remediation from the policy's remediation_guidelines), registered in _DETAILS_BY_POLICY
sca_table_printer.py	Advisory column, Malicious Packages title
README.md	option docs

text_printer and rich_printer both consume _DETAILS_BY_POLICY, so they need no changes.

Why the scan option is required

ScaScanDetectorBase.ShouldRunDetector runs a detector only when no [ScaScanDetector] option is mentioned, or when that detector's own option is explicitly true. The CLI always sends package_vulnerabilities / license_compliance / maintainability, so the "no opinion" path is already closed — without malicious_packages the detector never runs. The , False) default when the option is deselected is deliberate for the same reason.

Deliberate omission: no GHSA row

The ticket asks for a "GHSA- ID (if present)". That data does not exist: threat-service's packages/batch projects only the cluster's primary id (MAL- → CVE- → GHSA-), so there is exactly one threat_id to render. A GHSA row would always be empty.

Verification

Verified end to end against a live backend — cycode scan -t sca --sca-scan malicious-packages on a fixture containing flatmap-stream@0.1.1:

Package flatmap-stream was identified as malicious.    Violation 1 of 1
  Severity     ❗ CRITICAL
  Advisory     MAL-2025-20690
  Remediation  This package has been identified as malicious. Remove it from your dependencies.

102 unit tests pass (tests/cli/printers, tests/cli/commands/scan).

🤖 Generated with Claude Code

[omer-roth]

Reviewed for DRY / KISS / YAGNI. Scope and approach look good; comments below are about duplication and test overlap, none blocking except the remediation one, which also resolves the "Known nit" in the description.

[omer-roth]

@AradTraub thanks, the follow-up commit covers the review. I resolved the threads. Can you rebase on main once more? It's 1 commit behind (#576, gitpython bump). Then CI should go green and this is ready to approve.