NVD is drowning in backlog. OSV.dev aggregates 24 sources, tracks malicious packages, and doesn't need a government contract to stay alive.
