A couple unlikely edge-cases:

* A dependency is installed in a relative path with one letter (eg `myproject/c`)
* A dependency is installed in a relative path with a colon (eg `myproject/::stuff::`)

Added mitigation for the first and comment to help identify the second.