diff --git a/src/signals/path-matchers.ts b/src/signals/path-matchers.ts
index 5fa21122aa..6caad510a8 100644
--- a/src/signals/path-matchers.ts
+++ b/src/signals/path-matchers.ts
@@ -59,7 +59,11 @@ function isGeneratedFileFrom(parts: NormalizedPath): boolean {
 }
 
 function isVendoredFileFrom(parts: NormalizedPath): boolean {
-  return /(^|\/)(vendor|vendored|third_party|third-party|node_modules)\//.test(parts.norm);
+  // bower_components (Bower) and jspm_packages (JSPM) are installed-dependency
+  // directories — the same vendored case as node_modules, not contributor source.
+  return /(^|\/)(vendor|vendored|third_party|third-party|node_modules|bower_components|jspm_packages)\//.test(
+    parts.norm,
+  );
 }
 
 function isLockfileFrom(parts: NormalizedPath): boolean {
diff --git a/test/unit/path-matchers.test.ts b/test/unit/path-matchers.test.ts
index b7c3176a2e..c2a6614041 100644
--- a/test/unit/path-matchers.test.ts
+++ b/test/unit/path-matchers.test.ts
@@ -41,7 +41,15 @@ describe("isGeneratedFile", () => {
 
 describe("isVendoredFile", () => {
   it("matches vendored / third-party directories", () => {
-    for (const path of ["vendor/lib.go", "vendored/x.js", "third_party/y.py", "third-party/z.ts", "node_modules/pkg/index.js"]) {
+    for (const path of [
+      "vendor/lib.go",
+      "vendored/x.js",
+      "third_party/y.py",
+      "third-party/z.ts",
+      "node_modules/pkg/index.js",
+      "bower_components/jquery/dist/jquery.js", // Bower
+      "jspm_packages/npm/lodash/index.js", // JSPM
+    ]) {
       expect(isVendoredFile(path)).toBe(true);
     }
   });