Fix critical false negative in check command on first run

[Mehran-Seifalinia]

Fix a critical false negative in the check command (and default invocation) on the very first run after installation or cache clearance.

Problem

When a user runs depx check <package> for the first time (no existing local index), the command does not wait for the malicious‑package index to finish downloading. Instead, it immediately queries the intelProvider, which may return not_found or clean because the background sync is still in progress.

Impact: A package that is actually malicious can be reported as safe (false negative). This undermines supply‑chain security in CI/CD pipelines and local audits.

Why it wasn't caught: Existing e2e tests always prime the cache via search or feed before testing check. No test covers a cold‑cache check invocation.

Solution

Add an explicit readiness check before creating the check.Service:

• Call intelProvider.SyncStatus().
• If LastSuccess.IsZero() (no successful sync yet), show a spinner "Downloading malicious package index…" and block on intelProvider.WaitBackgroundSync() until the index is fully downloaded.
• Only then proceed with the actual package checks.

Changes: cli/check.go – insert the readiness block right after the advisory‑ID branch and before check.NewService.

[neo-by-projectdiscovery]

Neo - PR Security Review

No security issues found

_{Comment @pdneo help for available commands. · Open in Neo}

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

_{Comment @pdneo help for available commands. · Open in Neo}

[Mehran-Seifalinia]

@pdneo review

[ehsandeep]

Hey, Thanks for PR, but I'm unabel to reproduce what you reported, can you share more details?

$ rm -rf ~/.cache/depx
$ depx apkeep         

       __               
  ____╱ ╱__  ____  _  __
 ╱ __  ╱ _ ╲╱ __ ╲│ │╱_╱
╱ ╱_╱ ╱  __╱ ╱_╱ ╱>  <  
╲__,_╱╲___╱ .___╱_╱│_│  
         ╱_╱            v0.1.0

[MAL-2026-3431] MALICIOUS · apkeep (PyPI) · 32d
  ↳ Package: https://pypi.org/project/apkeep/
  ↳ OSV: https://osv.dev/vulnerability/MAL-2026-3431