fix: PackageURLs for private components

HISTORY.md

@@ -6,6 +6,12 @@ All notable changes to this project will be documented in this file.
 
 <!-- unreleased changes go here -->
 
+* Fixed
+  * Properly generate PackageURLs for private packages ([#1425] via [#1426]) 
+
+[#1425]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/1425
+[#1426]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1426
+
 ## 4.2.0 - 2026-03-03
 
 * Fixed

src/factories.ts

@@ -32,10 +32,7 @@ import type {PackageData} from "./_types"
 export class PackageUrlFactory {
 
   makeFromPackageData(data: PackageData): PackageURL | undefined {
-    if ( data.private === true ) {
-      // Per PackageUrl spec, private packages do not have one.
-      return undefined
-    }
+    // !REMINDER: even private packages may have a PURL
 
     let name: string = data.name
     let namespace: string | undefined = undefined
@@ -75,10 +72,7 @@ export class PackageUrlFactory {
   }
 
   makeFromPackageJson(packageJson: normalizePackageData.Package): PackageURL | undefined {
-    if ( packageJson.private === true ) {
-      // Per PackageUrl spec, private packages do not have one.
-      return undefined
-    }
+    // !REMINDER: even private packages may have a PURL
 
     let name: string = packageJson.name
     let namespace: string | undefined = undefined