Ecosystem support for tooling that is outside of the language or os specific package management system

It would be incredibly useful to have some standard way of referring to generic tooling that is part of a language or OS ecosystem, but not actually installed via that ecosystem's package registry.

An example might be cargo, which is a part of the rust ecosystem and has advisories issued from the Rust Advisory Database but is apart from the existing crates.io OSV ecosystem (some previous discussion on this)

Or a very recent example would be some way to refer to generic nodejs that hasn't been installed via a system package manager and would be separate from the existing npm OSV ecosystem, but still quite important to have some standard way of representing security advisories for. That would also hopefully open the door to flagging these tools within the existing GitHub Advisory Database for the languages they currently support

Start with the examples involving cargo, the Rust Advisory Database, generic nodejs, npm, and the GitHub Advisory Database, then read the linked prior discussion. Done means agreeing on a standard way to represent ecosystem tooling outside its package registry and documenting how that representation supports security advisories.