Use vendor alias only for name based searches

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

Author: prabhu

depscan/lib/normalize.py

@@ -100,7 +100,7 @@ def create_pkg_variations(pkg_dict):
         ]:
             vendor_aliases.add("golang")
     if pkg_type not in config.OS_PKG_TYPES:
-        if purl.startswith("pkg:composer"):
+        if not vendor and purl.startswith("pkg:composer"):
             vendor_aliases.add("get" + name)
             vendor_aliases.add(name + "_project")
         for k, v in config.vendor_alias.items():

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "owasp-depscan"
-version = "5.2.0"
+version = "5.2.1"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},