Question: problem with npm importer or something else?

We're running a vulnerablecode instance here [https://vulnerablecode.atomist.com/](https://vulnerablecode.atomist.com/), and have been doing some spot-checks on the data, and often see confusing results.

Take for example: https://nvd.nist.gov/vuln/detail/CVE-2021-32640

This was reported by Github, and is present on npmjs.org too.

However, a search for this on our vulnerablecode instance (on which we've run all the importers), doesn't show the npmjs package, just the debian ones (no purl with name `ws`, just `node-ws`)

https://vulnerablecode.atomist.com/vulnerabilities/20110

I'm curious about whether this is expected or are there bugs somewhere in the importers? Perhaps one importer is overwriting data from another? Or perhaps the npm importer isn't storing any data?

FWIW: running `npm audit` on a project with an old version of `ws` does suggest an upgrade, and this uses the same APIs as the npm importer AFAIK.

Any insights would be much appreciated.