Dependabot alerts incorrectly match npm packages with different casing (JSONPath vs jsonpath)

Package ecosystem

npm

Description

Dependabot security alerts are incorrectly matching npm packages whose names differ only in casing. npm package names are case-sensitive — JSONPath and jsonpath are two entirely different packages by different authors with different codebases:

What happened

Repositories that depend on JSONPath (uppercase, by s3u) are receiving Dependabot security alerts for vulnerabilities that only affect jsonpath (lowercase, by dchester):

• CVE-2025-61140 — Prototype Pollution (CVSS 9.8) in jsonpath
• CVE-2026-1615 / GHSA-87r5-mp6g-5w5j — Arbitrary Code Injection in jsonpath

These vulnerabilities exist only in the jsonpath package (lowercase, by dchester). The JSONPath package (uppercase, by s3u) is unrelated and unaffected.

How to verify

On a repository that uses JSONPath (uppercase) and receives these alerts:

npm ls jsonpath
# Returns empty — the lowercase package is not installed

yarn why jsonpath
# Returns "We couldn't find a match!"

The lockfile contains JSONPath but does not contain jsonpath. The vulnerable package is simply not in the dependency tree.

Expected behavior

Dependabot should perform case-sensitive matching for npm package names, since npm treats package names as case-sensitive. An advisory filed against jsonpath should not match JSONPath.

Actual behavior

Dependabot appears to normalize npm package names to lowercase (or perform case-insensitive comparison) when matching advisories to lockfile entries, causing false-positive alerts on unrelated packages that differ only in casing.

Prior report

This is the same class of bug reported in #4204 (Sep 2021), where JSON (uppercase) was incorrectly matched against advisories for json (lowercase). In that issue, a maintainer noted the alerting team had been notified and "spotted at least one thing they need to fix," but the issue was closed without a public resolution. The bug appears to still be present.

Start by tracing npm advisory matching from the lockfile entry through the alert comparison; the issue provides no source file or test path. Reproduce with distinct JSONPath/jsonpath package names and the shown npm and yarn commands, then confirm advisories for jsonpath no longer match JSONPath.