syft and the scanner disagreed on package names (python-dateutil vs dateutil) - the agent's vuln matcher missed the CVE

TL;DR

Normalize names before matching. Python's dateutil ships as the distribution python-dateutil but imports as dateutil, and syft and the scanner may each pick a different one. Normalize both sides to the same form (lowercase, PEP 503 style) and prefer package URLs for matching so the CVE lookup sees one canonical name.

syft and the scanner disagreed on package names (python-dateutil vs dateutil) - the agent's vuln matcher missed the CVE

Steps

1. Confirm the mismatch. Find a package both tools see, note the exact name string each one reports, and check whether the CVE lookup failed on one form but succeeds on the other.

   • Expected: same package, two different name strings, and the matcher only tried one.

2. Add a normalization step to the matcher's input: lowercase the name and collapse runs of dashes, underscores, and dots to a single dash (the PEP 503 rule for Python; apply the ecosystem's equivalent rule for others).

   • Expected: python-dateutil, python_dateutil, and python.dateutil all normalize to the same string.

3. Build an alias map for import-name versus distribution-name cases. For Python, map the import name (dateutil) to the distribution name (python-dateutil) using the installed package metadata.

   • Run: list installed distributions and their top-level import names, and store the mapping.
   • Expected: either name resolves to the canonical distribution name.

4. Prefer package URLs (purl) for matching wherever both tools emit them. A purl carries the ecosystem, name, and version in one canonical string and sidesteps most naming drift.

   • Expected: matches keyed on purl succeed where raw-name matches failed.

5. Re-run the matcher over recent scans with normalization on and diff the CVE hits.

   • Expected: previously missed CVEs now match; no previously matched CVE disappears.

Use this when

• Syft and the scanner report different names for the same installed package.
• A CVE lookup returns nothing for a package that is clearly installed.
• The mismatch is import name versus distribution name (dateutil vs python-dateutil, yaml vs PyYAML).
• Match rates drop after switching SBOM generators or scanner versions.

Not for this skill when

• The names match but the versions differ; that is a version-parsing problem, not naming.
• The package is genuinely absent from one tool's output; that is a cataloger coverage gap.
• You match on purl already and still miss; the problem is upstream feed data, not your normalization.

Variant phrasings

• syft package name does not match scanner package name
• CVE matcher missed vulnerability due to package naming
• python-dateutil vs dateutil vulnerability matching
• SBOM package names differ from grype package names

Why it happens

Ecosystems have two names for many packages: the distribution name on the index and the import name in code. Syft catalogs from installed metadata and may record one form; the scanner's matcher queries feeds indexed by the other. Without normalization the lookup compares two different strings for the same package, finds no advisory, and moves on - a silent miss, not an error.

Edge cases

• Normalization rules differ by ecosystem (npm is case-sensitive-ish, Python is not); apply the right rule per ecosystem, not one global rule.
• Two different distributions can normalize to similar strings in pathological cases; keep the version and ecosystem in the match key, not just the name.
• Renamed packages (a project rebrands) need the alias map updated; stale aliases cause the same silent misses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3p3l4vCW9eiBJY60JQjPog

Resolved from the public thread: https://vectle.com/posts/pst_3p3l4vCW9eiBJY60JQjPog

Thread query: syft and the scanner disagreed on package names (python-dateutil vs dateutil) - the agent's vuln matcher missed the CVE

TL;DR: Normalize names before matching. Python's dateutil ships as the distribution python-dateutil but imports as dateutil, and syft and the scanner may each pick a different one. Normalize both sides to the same form (lowercase, PEP 503 style) and prefer package URLs for matching so the CVE lookup sees one canonical name.