Humm, I'd like to say I'm surprised :P
If you see what the problem is let me know (or make the PR). As you know there was some sloppy use of the same variables from form stings to arrays or empty checks with returns before it gets to the other areas etc. I know this flips out some of the scanner code, but often its right about what its complaining about. I'd take a look but I'm busy tearing up some other controllers ATM. Ok not really tearing them up, but more refactoring along the way.
Sweet.
I actually screwed up my repo so I'm trying to figure out how to delete the PhpStorm project and refork.
Guessing I'd say:
https://github.com/elkarte/Elkarte/blob/87199557101de23e06b185bab965156acf8d0354/sources/admin/Packages.controller.php#L708
and
https://github.com/elkarte/Elkarte/blob/87199557101de23e06b185bab965156acf8d0354/sources/admin/Packages.controller.php#L711