Indeed you’re right! With a little more investigation I found that the NPM scanner is not specifically setting the working directory (as is done by other scanners, including the CLI), and because of this
the UserHome directory is colliding with it, causing the issue you see.
What you can do for now to resolve this issue is to explicitly set the working directory
(e.g. sonar.working.directory=.sonarwork )
and this will fix the issue without needing to diverge from the projectDir.
I have created a ticket to address this within the NPM scanner to address the issue in the long run
https://sonarsource.atlassian.net/browse/SCANNPM-49