Critical Vulnerability reported on monorepo-symlink-test - False Negative

[bzemms]

Grype is reporting that this internal test
monorepo-symlink-test in https://github.com/browserify/resolve/blob/main/test/resolver/multirepo/package.json
is critical

monorepo-symlink-test  0.0.0                npm   GHSA-2jcg-qqmg-46q6  Critical

It's a false negative since is not the real pkg monorepo-symlink-test https://security.snyk.io/vuln/SNYK-JS-MONOREPOSYMLINKTEST-5865510

Can you change this name?

[ljharb]

Because it's a private package that just coincidentally has the same name as the malicious one, it is a false positive - so whatever tool is flagging this repo is broken, and you should strongly reconsider using a tool that is this naive about npm package names.

Duplicate of #303. Duplicate of #291. Duplicate of #288. Duplicate of #304. Duplicate of #305. Duplicate of #306. Duplicate of #309. Duplicate of #310. Duplicate of #311. Duplicate of #312. Duplicate of #314.

I'm not going to change the name so that a poorly implemented tool can hide its failure.