We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue.
Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same.
Ideally even these local packages would be scoped, but they are referenced from workspace so the 1.0.0 it is pulling is from its own repo.
There is no provenance push that I have seen and JFrog just looks at names and versions in many cases so it should fall into your false positive handling process with the control.