GeezerVison

Renders the "Malicious package found" SCA policy (1fe6d83a-19de-48a2-a5ba-a80fe648489b) in scan output, and adds the scan option needed for the backend to run the detector at all.

Mirrors CM-68446 (unmaintained packages), which is the template for every file here.

Changes

text_printer and rich_printer both consume _DETAILS_BY_POLICY, so they need no changes.

Why the scan option is required

ScaScanDetectorBase.ShouldRunDetector runs a detector only when no [ScaScanDetector] option is mentioned, or when that detector's own option is explicitly true. The CLI always sends package_vulnerabilities / license_compliance / maintainability, so the "no opinion" path is already closed — without malicious_packages the detector never runs. The , False) default when the option is deselected is deliberate for the same reason.

Deliberate omission: no GHSA row

The ticket asks for a "GHSA- ID (if present)". That data does not exist: threat-service's packages/batch projects only the cluster's primary id (MAL- → CVE- → GHSA-), so there is exactly one threat_id to render. A GHSA row would always be empty.

Verification

Verified end to end against a live backend — cycode scan -t sca --sca-scan malicious-packages on a fixture containing [email protected]:

Package flatmap-stream was identified as malicious.    Violation 1 of 1
  Severity     ❗ CRITICAL
  Advisory     MAL-2025-20690
  Remediation  This package has been identified as malicious. Remove it from your dependencies.

102 unit tests pass (tests/cli/printers, tests/cli/commands/scan).

🤖 Generated with Claude Code