npm finding for local package on package-lock.lock - false positive?

[nirhaas]

Hi. I ran osv-scanner on a databricks/app-template template and encountered a potential false positive match.

The project's package-lock.json includes a package which is a link to a local path.

    "node_modules/@chat-template/auth": {
      "resolved": "packages/auth",
      "link": true
    },

However, osv-scanner flags this against MAL-2026-5124, which is a malicious package advisory intended for the @chat-template/auth npm registry package (no longer available apparently).

Considering the package is a link to a local directory, and not the npm package - I think this is a false positive.

Possible related issues:
#1861
google/osv-scalibr#808

Thanks

[binitpoks-code]

I’d like to work on this if it makes sense. My plan is to reproduce the package-lock local linked package case, identify where local/link npm packages are converted into OSV npm registry queries, and add a focused test/fix so local linked packages are not matched against unrelated npm registry advisories.

Could you confirm whether this is a valid direction before I start?