CM-72593: Surface malicious package detections in SCA scan output

[AradTraub]

Renders the "Malicious package found" SCA policy (1fe6d83a-19de-48a2-a5ba-a80fe648489b) in scan output, and adds the scan option needed for the backend to run the detector at all.

Mirrors CM-68446 (unmaintained packages), which is the template for every file here.

Changes

File	Change
consts.py	MALICIOUS_PACKAGE_POLICY_ID
cli_types.py	ScaScanTypeOption.MALICIOUS_PACKAGES
scan_command.py	malicious-packages added to the --sca-scan default set
scan_parameters.py	malicious_packages wire parameter
sca_policy_details.py	Advisory + Remediation rows, registered in _DETAILS_BY_POLICY
sca_table_printer.py	Advisory column, Malicious Packages title
README.md	option docs

text_printer and rich_printer both consume _DETAILS_BY_POLICY, so they need no changes.

Why the scan option is required

ScaScanDetectorBase.ShouldRunDetector runs a detector only when no [ScaScanDetector] option is mentioned, or when that detector's own option is explicitly true. The CLI always sends package_vulnerabilities / license_compliance / maintainability, so the "no opinion" path is already closed — without malicious_packages the detector never runs. The , False) default when the option is deselected is deliberate for the same reason.

Deliberate omission: no GHSA row

The ticket asks for a "GHSA- ID (if present)". That data does not exist: threat-service's packages/batch projects only the cluster's primary id (MAL- → CVE- → GHSA-), so there is exactly one threat_id to render. A GHSA row would always be empty.

Verification

Verified end to end against a live backend — cycode scan -t sca --sca-scan malicious-packages on a fixture containing flatmap-stream@0.1.1:

Package flatmap-stream was identified as malicious.    Violation 1 of 1
  Severity     ❗ CRITICAL
  Advisory     MAL-2025-20690
  Remediation  This package has been identified as malicious. Remove it from your dependencies immediately.

75 unit tests pass (tests/cli/printers, tests/cli/commands/scan).

Known nit

The Remediation constant reads "…Remove it from your dependencies immediately." while the policy's seeded remediation_guidelines — and therefore the PR comment — says "…Remove it from your dependencies." Left as-is intentionally; happy to align if reviewers prefer.

🤖 Generated with Claude Code