npm finding for local package on package-lock.lock - false positive?

Hi. I ran osv-scanner on a [databricks/app-template](https://github.com/databricks/app-templates/tree/main/e2e-chatbot-app-next) template and encountered a potential false positive match.

The project's [package-lock.json](https://github.com/databricks/app-templates/blob/main/e2e-chatbot-app-next/package-lock.json#L745-L748) includes a package which is a link to a local path.

```
"node_modules/@chat-template/auth": {
"resolved": "packages/auth",
"link": true
},
```

However, osv-scanner flags this against [MAL-2026-5124](https://osv.dev/vulnerability/MAL-2026-5124), which is a malicious package advisory intended for the [@chat-template/auth npm registry package](https://www.npmjs.com/package/@chat-template/auth) (no longer available apparently).

Considering the package is a link to a local directory, and not the npm package - I think this is a false positive.

Possible related issues:
#1861
https://github.com/google/osv-scalibr/issues/808

Thanks