Summary

Active (on-demand) malware analysis has been retired in vet (see safedep/vet#752). Scanning is now a fast lookup against SafeDep's known malicious packages database and requires no API key. This PR updates the Malware Analysis page (and one stale FAQ reference) to match.

Changes

governance/cloud/malware-analysis.mdx

• Reframed the page around querying known malicious packages with --malware-query (noted --malware as a deprecated alias that behaves identically).
• Dropped the mandatory API key / SafeDep Cloud onboarding requirement; clarified that a cloud account is optional (report sync, higher rate limits).
• Removed content that only applied to on-demand analysis:
  • the --malware-analysis-timeout flag and the "Timeout Configuration" section (the flag is now a deprecated no-op);
  • the "waits for a timeout period … async" note;
  • the entire Package Inspection section — vet inspect malware has been retired and now returns a useful error, so the doc no longer instructs users to run it (also removed the corresponding bottom card and the VET_ENABLE_PACKAGE_INSPECT_COMMAND step).
• Made CI examples (GitLab, Jenkins) keyless and switched them to --malware-query.
• Renamed "Analysis Techniques" → "How Packages Are Analyzed" and clarified that SafeDep performs the analysis continuously in the cloud while vet queries the results.
• Reworked Troubleshooting: removed the timeout and authentication accordions (no auth needed); added a "package not flagged" note explaining only already-known packages are reported.

faq.mdx

• Updated the performance FAQ that recommended --malware --malware-analysis-timeout 5m to reflect the fast keyless --malware-query lookup.

Notes for reviewers

• The vet-action GitHub Actions example was kept but reframed: known-malicious detection needs no key, and the cloud-key/cloud-tenant config is called out as optional for cloud reporting only. If vet-action exposes a more precise keyless malware invocation, happy to adjust.
• I intentionally scoped this to the malware-analysis page plus the one contradicting FAQ example. A repo-wide grep found no other pages referencing the retired flags/command.

🤖 Generated with Claude Code

Generated by Claude Code