Today I saw the API of EOL was upgraded and full information can be extracted from the API.
I think it is possible now to add this information to grype.
here is the relevant issue - Add capability to detect EOL packages and distros · Issue #2083 · anchore/grype · GitHub
2 Likes
any thoughts? It was almost a year ago. it is already merged to vunnel
Unfortunately today the EOL support is currently only for distros, not packages. There isn’t a spot in the data model to put package-level EOL data data yet. I would love to see it too! I think there are a few other things still higher priority, but definitely agree this would be really useful 
It may help to model package EOL separately from distro EOL, since a distro can continue patching a package after its upstream project stops supporting it. Storing the source and EOL date alongside the package identity would also make the result traceable and avoid treating those two lifecycle signals as interchangeable.
see my suggestion