diff --git a/pkg/npm/publish.go b/pkg/npm/publish.go
index 42b6821574..a5626281b3 100644
--- a/pkg/npm/publish.go
+++ b/pkg/npm/publish.go
@@ -218,7 +218,7 @@ func (exec *Execute) publish(packageJSON, registry, username, password string, p
 			coordinate.BuildPath = filepath.Dir(packageJSON)
 			coordinate.URL = registry
 			coordinate.Packaging = "tgz"
-			coordinate.PURL = piperutils.GetPurl(filepath.Join(packageJSON, npmBomFilename))
+			coordinate.PURL = piperutils.GetPurl(filepath.Join(filepath.Dir(packageJSON), npmBomFilename))
 
 			*buildCoordinates = append(*buildCoordinates, coordinate)
 		}