Inspector incorrectly flagging Npm vulnerabilities

Hello Alan, we do have some templates to submit Inspector false positives so I may be able to help. Can you tell me if this false positive is detected in EC2, ECR or Lambda?

Detected in ECR. The github link shows a history of closed project issues. In these the project contributor indicates the false positive is due to Inspector's heuristic methods used to detect the vuln likely limiting to matching on name, and being insufficient in this edge case where they have included a private node package in the project that includes tests (due to npm cmd resolution requirements). The contributor fully acknowledges the name collision w/ known malicious pkg, but refuses to edit it on principle of driving adoption of more accurate detection methods in scan tools.