docs: nvm malware status and NVM4602 reason

docs/command/nvm/malware.md

@@ -0,0 +1,27 @@
+---
+title: malware
+sidebar_position: 11
+---
+
+# nvm malware
+
+Show the **local** malware verdict for package names. This command does not POST to an organization URL.
+
+A block at install time is separate. The package-manager shim prints **NVM4602** and may show a toast.
+
+## Usage
+
+```powershell
+nvm malware status <module> [<module> ...] [flags]
+```
+
+## Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| [`status`](./malware/status) | Local verdict for each name. Does not consult a remote policy URL. |
+
+## Notes
+
+- `evaluate` and `notify-block` stay internal. The shim calls them during an install.
+- Verdicts are not written back to policy.

docs/command/nvm/malware/status.md

@@ -0,0 +1,71 @@
+---
+title: status
+sidebar_position: 1
+---
+
+# nvm malware status
+
+Show the local malware verdict for one or more package names.
+
+The command reads `malware.db`, `MalwareAllowList`, and (Certified Builds) `MalwareBlockList`. It does **not** POST to an organization HTTPS URL. If that URL is configured, JSON includes `remote_configured` and `remote` is `configured, not consulted`.
+
+A later `npm install` (or equivalent) still runs the remote check. Use this command to inspect the local lists.
+
+## Usage
+
+```powershell
+nvm malware status <module> [<module> ...] [flags]
+```
+
+## Flags
+
+| Flag | Description |
+|------|-------------|
+| `--json` | Write one JSON array of verdict rows. |
+
+## Output
+
+Three aligned columns. No header. Status is `blocked` or `allowed`.
+
+```text
+left-pad     blocked  recognized as malware by OpenSSF
+eslint       allowed  OpenSSF block overruled by malware acceptance policy
+evil         allowed  Malware block overruled by module trust policy
+[email protected] allowed  OpenSSF block overruled by approved module policy
+chalk        allowed  no malware detected
+```
+
+| Message | When |
+|---------|------|
+| recognized as malware by OpenSSF | Name hits `malware.db` |
+| blocked by organization malware policy | Certified Builds, local `MalwareBlockList` pattern |
+| OpenSSF block overruled by malware acceptance policy | `MalwareAllowList` cleared an OpenSSF hit |
+| OpenSSF block overruled by module trust policy | `MalwareTrustConflict=continue` and TrustedModules |
+| Malware block overruled by module trust policy | same, for a local org-list hit |
+| OpenSSF block overruled by approved module policy | `continue` and ApprovedModules |
+| OpenSSF block overruled by approved global module policy | `continue` and ApprovedGlobalModules |
+| malware checks skipped | `skip_malware_checks` is on |
+| malware definitions are missing or invalid | `malware.db` missing or invalid |
+| no malware detected | Name missed every list |
+
+An `allowed` row with an "overruled" message still means OpenSSF (or the org list) hit. The named policy let it through.
+
+`--json` uses `status` (`allowed` / `blocked`), `message` (same sentences), and `source` (`OpenSSF`, `MalwareAllowList`, `TrustedModules`, …).
+
+`MalwareAllowList` wins if it also matches. If more than one grant matches, the source is TrustedModules, then ApprovedModules, then ApprovedGlobalModules.
+
+Trusted or approved names follow `MalwareTrustConflict`. `continue` matches the shim: `allowed` plus the overruled message. `prevent` (default) still blocks.
+
+Community Builds ignore `MalwareBlockList`.
+
+## Examples
+
+```powershell
+nvm malware status left-pad
+nvm malware status [email protected] eslint --json
+```
+
+## Related
+
+- [Malicious Package Blocker](../../../features/malicious-package-blocker)
+- [`nvm cache remove malware`](../cache/remove/malware)

docs/features/certified-builds/advanced-logging.md

@@ -90,7 +90,7 @@ Blocked activities still print in the terminal when Advanced Logging is off, but
 | Code | Event | Payload |
 |------|--------|---------|
 | **NVM4601** | `malware.definitions_updated` | `added`, `removed`, `seq`, `previous_seq` |
-| **NVM4602** | `malware.package_blocked` | package name, version when known, command |
+| **NVM4602** | `malware.package_blocked` | package name, version when known, command, `source`, `reason` |
 
 See [SIEM](../../guide/siem) for queries.
 See [Error Codes](../../troubleshooting/error-codes) for each `NVM####` value.

docs/features/log.md

@@ -27,4 +27,4 @@ These events are written only when advanced logging is on. They use Windows Even
 | Code | Event | Payload |
 |------|--------|---------|
 | **NVM4601** | `malware.definitions_updated` | `added`, `removed`, `seq`, `previous_seq` |
-| **NVM4602** | `malware.package_blocked` | package name, version when known, command |
+| **NVM4602** | `malware.package_blocked` | package name, version when known, command, `source`, `reason` |

docs/features/malicious-package-blocker.md

@@ -22,6 +22,10 @@ They are on by default on Community Builds and Certified Builds.
 
 A match is a terminal error.
 That install command does not continue.
+Each blocked name prints `NVM blocked <name> — <reason>. (NVM4602)`.
+OpenSSF uses `recognized as malware (OpenSSF)`.
+A local organization pattern uses `organization malware block`.
+A remote 403 uses `remote malware policy`, then `: <reason>` when the TSV column is present.
 
 ## What it checks
 
@@ -85,11 +89,35 @@ Bundled package-manager trust seeds (`npm`, `npx`, `yarn`, `yarnpkg`, `corepack`
 A malware block does not write `package_manager.install`.
 **NVM4602** is the record when Advanced Logging is on.
 
+### Remote HTTPS body (Certified Builds)
+
+When `MalwareBlockList` is one `https://` URL, the shim POSTs hits during install. A **403** body is TSV:
+
+```text
+name<TAB>date<TAB>reason
+```
+
+`reason` is optional. Empty reason uses `remote malware policy`. A custom reason is used only for that request. It is not written back to policy.
+
+Local `MalwareBlockList` patterns stay `organization malware block`. They do not take a custom reason.
+
+### Inspect a name
+
+```powershell
+nvm malware status left-pad
+nvm malware status left-pad --json
+```
+
+`status` is local only. It does not POST.
+An `allowed` row whose message says the block was overruled still means OpenSSF (or the org list) hit. That policy let it through.
+See [`nvm malware status`](../command/nvm/malware/status).
+
 ## Notifications
 
 A hit always prints in the terminal.
 
-When the console is in the background, Windows also shows **Malicious package blocked**.
+When the console is in the background, Windows also shows a toast.
+The title is **Malicious package blocked** for OpenSSF-only hits, **Organization malware block** for local-list-only hits, and **Package blocked** when sources mix or a remote 403 kept the name.
 The body names at most three packages, then `and N more`.
 The cue is `Notification.Reminder`.
 [`disable_announcements`](../cfg/core#logging-and-announcements) does not hide this toast.
@@ -123,7 +151,7 @@ They use Windows Event ID 120 on **NVM for Windows/Operational**.
 | Code | Event |
 |:-|:-|
 | **NVM4601** | `malware.definitions_updated` |
-| **NVM4602** | `malware.package_blocked` |
+| **NVM4602** | `malware.package_blocked` — package, version, command, `source`, `reason` |
 
 See [Event Logging](./log) and [Error Codes](../troubleshooting/error-codes).
 

docs/guide/siem.md

@@ -106,7 +106,7 @@ A malware block does not write this event. Use **NVM4602** instead.
 
 <SiemQuery id="malwareBlocks" />
 
-Inspect `Payload` for the package name, version when known, and command.
+Inspect `Payload` for the package name, version when known, command, `source`, and `reason`.
 
 ### Integrity verification failures
 

docs/troubleshooting/error-codes.md

@@ -38,7 +38,7 @@ NVM for Windows uses stable `NVM####` codes in CLI messages, shim/proxy output,
 | **NVM4411** | Version firewall blocked a Node.js version | Certified `VersionAllowList` / `VersionBlockList` denied `nvm install`, `nvm use`, or a Certified shim launch. Community ACL is a no-op |
 | **NVM4412** | Package-manager lifecycle scripts blocked | Audit (non-error), Advanced Logging on Certified Builds only. HKLM `BlockPackageManagerLifecycleScripts` rewrote an install-class command (`install` / `ci` / `add` / …). `npm --version` and `npm run` do not write this event. EventName `package_manager.lifecycle_scripts_blocked`. Windows Event ID 120 |
 | **NVM4601** | Malware definitions updated | Informational, advanced logging only. A successful `malware.db` write changed the database. Payload: `added`, `removed`, `seq`, `previous_seq`. Windows Event ID 120 |
-| **NVM4602** | Malicious package blocked | Informational, advanced logging only. The shim blocked a package before the install audit. Payload includes the package name, version when known, and command. The terminal message still prints without the advanced logging license. Windows Event ID 120 |
+| **NVM4602** | Malicious package blocked | Informational, advanced logging only. The shim blocked a package before the install audit. Payload includes the package name, version when known, command, `source` (`OpenSSF`, `MalwareBlockList`, or `remote`), and `reason`. The terminal line is `NVM blocked <name> — <reason>. (NVM4602)`. It still prints without the advanced logging license. Windows Event ID 120 |
 
 ## Ranges
 

i18n/ru/docusaurus-plugin-content-docs/current/command/nvm/malware.md

@@ -0,0 +1,27 @@
+---
+title: malware
+sidebar_position: 11
+---
+
+# nvm malware
+
+Показать **локальный** вердикт malware для имён пакетов. Эта команда не делает POST на URL организации.
+
+Блок при установке — отдельно. Shim менеджера пакетов печатает **NVM4602** и может показать toast.
+
+## Использование
+
+```powershell
+nvm malware status <module> [<module> ...] [flags]
+```
+
+## Подкоманды
+
+| Подкоманда | Описание |
+|------------|----------|
+| [`status`](./malware/status) | Локальный вердикт для каждого имени. Не обращается к удалённому URL политики. |
+
+## Примечания
+
+- `evaluate` и `notify-block` остаются внутренними. Shim вызывает их при установке.
+- Вердикты не пишутся обратно в политику.

i18n/ru/docusaurus-plugin-content-docs/current/command/nvm/malware/status.md

@@ -0,0 +1,71 @@
+---
+title: status
+sidebar_position: 1
+---
+
+# nvm malware status
+
+Показать локальный вердикт malware для одного или нескольких имён пакетов.
+
+Команда читает `malware.db`, `MalwareAllowList` и (Certified Builds) `MalwareBlockList`. Она **не** делает POST на HTTPS URL организации. Если URL задан, JSON содержит `remote_configured`, а `remote` равно `configured, not consulted`.
+
+Позже `npm install` (или эквивалент) всё равно выполнит удалённую проверку. Эта команда смотрит локальные списки.
+
+## Использование
+
+```powershell
+nvm malware status <module> [<module> ...] [flags]
+```
+
+## Флаги
+
+| Флаг | Описание |
+|------|----------|
+| `--json` | Записать один JSON-массив строк вердикта. |
+
+## Вывод
+
+Три выровненных столбца. Без заголовка. Статус — `blocked` или `allowed`.
+
+```text
+left-pad     blocked  recognized as malware by OpenSSF
+eslint       allowed  OpenSSF block overruled by malware acceptance policy
+evil         allowed  Malware block overruled by module trust policy
+[email protected] allowed  OpenSSF block overruled by approved module policy
+chalk        allowed  no malware detected
+```
+
+| Сообщение | Когда |
+|-----------|-------|
+| recognized as malware by OpenSSF | Имя есть в `malware.db` |
+| blocked by organization malware policy | Certified Builds, локальный шаблон `MalwareBlockList` |
+| OpenSSF block overruled by malware acceptance policy | `MalwareAllowList` снял попадание OpenSSF |
+| OpenSSF block overruled by module trust policy | `MalwareTrustConflict=continue` и TrustedModules |
+| Malware block overruled by module trust policy | то же, для локального оргсписка |
+| OpenSSF block overruled by approved module policy | `continue` и ApprovedModules |
+| OpenSSF block overruled by approved global module policy | `continue` и ApprovedGlobalModules |
+| malware checks skipped | включён `skip_malware_checks` |
+| malware definitions are missing or invalid | нет или неверен `malware.db` |
+| no malware detected | Имя не попало ни в один список |
+
+Строка `allowed` с текстом "overruled" всё равно значит попадание OpenSSF (или оргсписка). Названная политика пропустила имя.
+
+`--json` использует `status` (`allowed` / `blocked`), `message` (те же фразы) и `source` (`OpenSSF`, `MalwareAllowList`, `TrustedModules`, …).
+
+`MalwareAllowList` важнее, если тоже совпал. Если грантов несколько, источник — TrustedModules, затем ApprovedModules, затем ApprovedGlobalModules.
+
+Доверенные или одобренные имена следуют `MalwareTrustConflict`. `continue` совпадает с shim: `allowed` плюс сообщение overruled. `prevent` (по умолчанию) всё равно блокирует.
+
+Community Builds игнорируют `MalwareBlockList`.
+
+## Примеры
+
+```powershell
+nvm malware status left-pad
+nvm malware status [email protected] eslint --json
+```
+
+## Связанные материалы
+
+- [Блокировщик вредоносных пакетов](../../../features/malicious-package-blocker)
+- [`nvm cache remove malware`](../cache/remove/malware)

i18n/ru/docusaurus-plugin-content-docs/current/features/certified-builds/advanced-logging.md

@@ -85,7 +85,7 @@ Certified Builds уже пишут в **NVM for Windows/Operational** без э
 | Код | Событие | Payload |
 |------|--------|---------|
 | **NVM4601** | `malware.definitions_updated` | `added`, `removed`, `seq`, `previous_seq` |
-| **NVM4602** | `malware.package_blocked` | имя пакета, версия если известна, команда |
+| **NVM4602** | `malware.package_blocked` | имя пакета, версия если известна, команда, `source`, `reason` |
 
 См. [SIEM](../../guide/siem) для запросов.
 См. [Коды ошибок](../../troubleshooting/error-codes) для каждого значения `NVM####`.

i18n/ru/docusaurus-plugin-content-docs/current/features/malicious-package-blocker.md

@@ -22,6 +22,10 @@ Module firewall применяет **ваши** списки allow и deny.
 
 Совпадение — терминальная ошибка.
 Эта команда установки не продолжается.
+Каждое заблокированное имя печатает `NVM blocked <name> — <reason>. (NVM4602)`.
+OpenSSF использует `recognized as malware (OpenSSF)`.
+Локальный шаблон организации использует `organization malware block`.
+Удалённый 403 использует `remote malware policy`, затем `: <reason>`, если колонка TSV есть.
 
 ## Что проверяется \{#what-it-checks\}
 
@@ -85,11 +89,35 @@ Certified Builds также читают:
 Блок malware не пишет `package_manager.install`.
 **NVM4602** — запись, когда включён Advanced Logging.
 
+### Удалённое тело HTTPS (Certified Builds) \{#remote-https-body-certified-builds\}
+
+Когда `MalwareBlockList` — один URL `https://`, shim POSTит попадания при установке. Тело **403** — TSV:
+
+```text
+name<TAB>date<TAB>reason
+```
+
+`reason` необязателен. Пустой reason даёт `remote malware policy`. Свой reason живёт только в этом запросе. Он не пишется обратно в политику.
+
+Локальные шаблоны `MalwareBlockList` остаются `organization malware block`. Они не берут свой reason.
+
+### Проверить имя \{#inspect-a-name\}
+
+```powershell
+nvm malware status left-pad
+nvm malware status left-pad --json
+```
+
+`status` только локальный. Он не делает POST.
+Строка `allowed` с текстом overruled всё равно значит попадание OpenSSF (или оргсписка). Эта политика пропустила имя.
+См. [`nvm malware status`](../command/nvm/malware/status).
+
 ## Уведомления \{#notifications\}
 
 Попадание всегда печатается в терминале.
 
-Если консоль в фоне, Windows также показывает **Malicious package blocked**.
+Если консоль в фоне, Windows также показывает toast.
+Заголовок — **Malicious package blocked** только для OpenSSF, **Organization malware block** только для локального списка, и **Package blocked** при смеси источников или когда удалённый 403 оставил имя.
 Тело называет не более трёх пакетов, затем `and N more`.
 Сигнал — `Notification.Reminder`.
 [`disable_announcements`](../cfg/core#logging-and-announcements) это уведомление не скрывает.
@@ -123,7 +151,7 @@ nvm cache remove malware --prompt
 | Код | Событие |
 |:-|:-|
 | **NVM4601** | `malware.definitions_updated` |
-| **NVM4602** | `malware.package_blocked` |
+| **NVM4602** | `malware.package_blocked` — пакет, версия, команда, `source`, `reason` |
 
 См. [журналирование событий](./log) и [коды ошибок](../troubleshooting/error-codes).
 

i18n/ru/docusaurus-plugin-content-docs/current/guide/siem.md

@@ -111,7 +111,7 @@ Certified Builds пишут `package_manager.install`, когда межсете
 
 <SiemQuery id="malwareBlocks" />
 
-Смотрите `Payload` для имени пакета, версии если известна, и команды.
+Смотрите `Payload` для имени пакета, версии если известна, команды, `source` и `reason`.
 
 ## Сбои проверки целостности \{#integrity-verification-failures\}