I was running the collect endpoint on an npm package inherits 2.0.0 and it returned package data that included pkg:github/substack/node-browserify@2.0.0 as the source repo of inherits. This is an issue and I think a good place to start is the purl2vcs code that we call