aliased dependencies are fetched incorrectly #3294

Describe the bug

If a dependency has an alias, then the package that is fetched for metadata would be @, which would be incorrect.

An example of this was Vite+ rc.1, which currently lists 36 vulnerabilities, 5 deprecated dependencies, and +262 more dependencies than rc.0 because that's the statistics from Vite 1.0.0-rc.1.

Additional context

No response

Logs