v0.1.0: measure the NVD enrichment gap

First public release of cve-gap: a CLI that measures how much of the NVD enrichment gap remains after NIST's April 2026 policy change, and fills it from free sources.

Benchmark, CVEs published 2026-10-01 through 2026-10-17:

• 9,172 CVEs published
• 7,581 unenriched (82.7%) have no NVD analysis
• 6,521 of those carry vendor (CNA) CVSS
• 7,196 have an EPSS score
• 0 are in CISA KEV
• 45 (0.6%) have no free signal at all

Zero dependencies, Node 18+. Reproduce with:

node bin/cve-gap.mjs report --start 2026-10-01T00:00:00.000 --end 2026-10-18T00:00:00.000

Known limits: EPSS has no coverage for CVEs under roughly 48 hours old; numbers move as NVD backfills; OSV coverage in report mode is a sample. MIT licensed.