Huh. This looks pretty complementary to something I created a few months ago

https://supplychain.fail/

(CVE severity timeline)