Bumblebee — Supply Chain Security Scanner by Perplexity

Introduction

Bumblebee is an open-source supply chain security tool by Perplexity AI that scans your local development environment for exposure to known software supply-chain compromises. It operates in read-only mode, inventorying installed packages, IDE extensions, CLI tools, and their metadata without modifying anything on disk. The goal is to surface hidden risks in the developer toolchain before they become incidents.

What Bumblebee Does

• Scans installed npm, pip, cargo, and other package manager dependencies
• Inventories IDE extensions (VS Code, JetBrains) for known compromised versions
• Checks CLI tools and developer utilities against vulnerability databases
• Reports findings with severity levels and remediation guidance
• Runs entirely read-only with no modifications to your system

Architecture Overview

Bumblebee is a single Go binary that walks well-known paths for package managers, extension directories, and tool installations. It extracts version metadata and hashes, then cross-references them against a bundled and updatable database of known supply-chain compromises. The scanner uses goroutines to parallelize filesystem traversal across multiple package ecosystems. Results are output in human-readable or JSON format for integration with CI pipelines.

Self-Hosting & Configuration

• Install via go install or download prebuilt binaries from GitHub Releases
• Run bumblebee scan in any directory to start a full environment scan
• Configure scan scope with --include and --exclude flags for specific ecosystems
• Update the vulnerability database with bumblebee update
• Integrate into CI/CD by running on build agents and checking exit codes

Key Features

• Read-only scanning ensures zero risk of modifying your development environment
• Covers multiple ecosystems: npm, pip, cargo, go modules, IDE extensions
• Bundled vulnerability database with offline scanning capability
• JSON output for easy integration with security dashboards and CI gates
• Fast parallel scanning across all detected package ecosystems

Comparison with Similar Tools

• Snyk CLI — SaaS-dependent with usage limits; Bumblebee runs fully offline
• npm audit — limited to npm; Bumblebee covers multiple ecosystems
• Trivy — container-focused; Bumblebee targets developer workstation environments
• Socket.dev — monitors package registries; Bumblebee scans what is already installed
• Syft — generates SBOMs from containers; Bumblebee inventories local dev tools

FAQ

Q: Does it send any data to Perplexity servers? A: No, all scanning is local and offline by default. No telemetry is collected.

Q: How often is the vulnerability database updated? A: Updates are published regularly on GitHub. Run bumblebee update to pull the latest.

Q: Can it scan Docker containers? A: It focuses on the host development environment. For container scanning, tools like Trivy are more appropriate.

Q: Does it support Windows? A: Yes, prebuilt binaries are available for Linux, macOS, and Windows.

Sources

• https://github.com/perplexityai/bumblebee
• https://github.com/perplexityai/bumblebee/blob/main/README.md