Unfortunately `macaron` is already [picked on PyPI](https://pypi.org/project/macaron/#history) and the CycloneDX plugin wrongly produces a PURL for that package instead of ours.