Missing audit warnings from "nuget install" when nuget.org is not a package source

[hickford]

NuGet Product Used

NuGet.exe

Product Version

NuGet Version: 6.12.2.

Impact

It bothers me. A fix would be nice

Repro Steps & Context

Read https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages#audit-sources

audit sources can be used to use nuget.org (or any other source that provides vulnerability information) without also using it as a package source.

Edit nuget.config to include nuget.org as an audit source, but not a package source.

<configuration>
    <packageSources>
        <clear />
        <add key="hippo" value="https://artifactory.example.com/artifactory/api/nuget/v3/hippo/index.json" />
    </packageSources>
    <auditSources>
        <clear />
        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    </auditSources>
</configuration>

Then run nuget install packages.config that includes vulnerable packages

What I expected:

Audit warnings such as

WARNING: NU1902: Package 'Microsoft.IdentityModel.JsonWebTokens' 5.6.0 has a known moderate severity vulnerability, GHSA-59j7-ghrg-fj52
WARNING: NU1902: Package 'System.IdentityModel.Tokens.Jwt' 5.6.0 has a known moderate severity vulnerability, GHSA-59j7-ghrg-fj52

What actually happens:

Packages installed without any audit warnings.

nuget install System.IdentityModel.Tokens.Jwt -Version 1.0.0

[jeffkl]

Team Triage: install should audit individual packages