docs: document MAL- advisory handling and unverifiable private source findings (#591)

Closes #590

Author: sonukapoor

website/docs/how-remediation-works.mdx

@@ -541,6 +541,42 @@ Common skip reasons:
 
 ---
 
+## Malicious package advisories (MAL-)
+
+OSV includes a separate class of advisory for packages that were intentionally published with malicious code. These carry a `MAL-` prefix in their advisory ID (for example, `MAL-2026-3744`).
+
+CVE Lite CLI handles MAL- findings differently from CVE/GHSA findings because the nature of the risk is different:
+
+- **CVE/GHSA:** The vulnerability is in the package's code logic. `lodash@4.17.20` has a prototype pollution bug whether it came from the public npm registry or your private Artifactory mirror. The version is what matters.
+- **MAL-:** The maliciousness *is* the artifact. A specific package published to the public npm registry at a specific version contained injected malicious code. If your private registry has a package with the same name and version, it is a completely different artifact - the MAL- advisory may not apply.
+
+### Unverifiable (private source)
+
+When CVE Lite CLI detects that a package with a MAL- advisory resolved from a URL other than `https://registry.npmjs.org/`, it cannot confirm whether the advisory applies to your artifact. Instead of reporting a false-positive "Malicious" finding, it surfaces the finding as:
+
+```
+⚠ Unverifiable (private source) - MAL- advisory could not be confirmed for this artifact.
+```
+
+This means:
+- A MAL- advisory exists for a package with this name and version on the public npm registry
+- Your lockfile shows this package was installed from a different registry (private Artifactory, GitHub Packages, internal npm proxy, workspace link, etc.)
+- CVE Lite CLI cannot verify whether your artifact matches the malicious one
+
+**What to do:** Verify the artifact's integrity through your private registry's audit trail. If you are confident the package is trusted, the finding can be safely dismissed. If you are unsure, treat it as a risk until verified.
+
+### Confirmed malicious
+
+If the package resolved from `https://registry.npmjs.org/`, CVE Lite CLI treats the MAL- advisory as confirmed and displays:
+
+```
+⚠ Malicious - Remove this package from your dependencies immediately.
+```
+
+MAL- findings do not produce automated fix commands. The appropriate action is removal of the package or, for transitive findings, removal of the parent that pulls it in.
+
+---
+
 ## Current limitations
 
 CVE Lite CLI does not guarantee that a dependency upgrade is compatible with your application. It checks vulnerability and package metadata, not runtime behaviour.