It's based on https://github.com/anchore/grype and uses https://endoflife.date/ as a data source for EOL packages.