npm:phpmyadmin is both malicious and legitimate

As per OSV, all [versions](https://osv.dev/vulnerability/MAL-2022-5327) of npm:phpmyadmin are malicious.

However, this npm [package](https://github.com/phpmyadmin/phpmyadmin/blob/39670a0908bc9212a13e37e70b428bfe35867706/package.json#L2) is quite legitimate, although the project never publishes the same on npm.

Currently, when constructing or searching for a PURL, we don't really consider the `published` status of a package. Let's use this ticket to track some ideas.