Developer workstations have become a prime target. Attackers now focus on the scattered files, extensions, and configurations that live on engineers’ machines rather than hardened production systems.
Perplexity open-sourced Bumblebee on May 22, 2026. The tool scans macOS and Linux developer endpoints for risky packages, browser extensions, editor plugins, and AI agent configurations. It does so without executing code or invoking package managers. Perplexity blog describes it as a read-only inventory collector.
Bumblebee addresses a specific gap. SBOMs document what ships to production. EDR tools watch running processes. Neither captures the on-disk state of lockfiles, manifests, and MCP configs that sit idle on laptops until a new advisory arrives.
Recent supply-chain incidents highlight the stakes. A May 11, 2026 attack inserted malicious code into more than 160 packages used by millions of developers, including tools tied to Mistral AI and a React package with 12 million weekly downloads. Open Source For You reported that Bumblebee’s approach could have flagged exposure before install scripts ran.
Earlier breaches followed the same pattern. CircleCI’s 2022 incident originated from malware on an employee’s laptop. LastPass traced its compromise to a keylogger on a DevOps engineer’s home machine. DevOps.com noted these cases as evidence that dev desktops serve as entry points when pipelines and endpoints tighten.
Bumblebee operates through a five-step workflow that Perplexity uses internally and now shares.
A threat signal arrives from disclosures or feeds. Perplexity Computer drafts a structured catalog entry with ecosystem, name, and version, then opens a GitHub PR. Humans review and merge. Bumblebee runs against the updated catalog on endpoints. Findings route to the security team. Organizations can substitute their own catalogs and review processes.
The scanner covers multiple surfaces in one pass. It reads metadata from npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, and Composer lockfiles and manifests. It inspects VS Code-family editor extensions and Chromium- and Firefox-family browser extensions. It also parses MCP configuration files that grant AI assistants access to email, calendars, databases, and repositories. explainx.ai detailed the supported sources and noted that no existing open-source tool previously handled all four categories together.
Read-only design prevents the scan itself from becoming an attack vector. Bumblebee never runs install scripts, lifecycle hooks, or package managers. It skips source files and avoids process or network monitoring. This matters because many npm supply-chain worms activate on postinstall. Invoking npm to list packages would trigger the very code the scanner seeks to detect.
Three scan profiles match different operational needs. The baseline profile performs routine checks on standard locations and suits scheduled fleet runs via MDM or cron. The project profile targets specific workspaces for recurring inventory. The deep profile supports incident response with explicit root paths and findings-only output for speed.
Output arrives as NDJSON records. Package records include ecosystem, name, version, source path, and confidence level. Findings tie directly to catalog entries with traceable IDs and timestamps. A summary record closes each scan with counts and coverage details. Teams pipe results into existing SIEM or ticketing systems without new infrastructure.
ZDNet compared Bumblebee to Chainguard on May 28, 2026. Chainguard hardens containers and pipelines with minimal base images and automated rebuilds. Bumblebee sits earlier in the lifecycle on the developer laptop itself. ZDNet observed that both approaches complement each other rather than compete.
Adoption signals appear quickly. The GitHub repository reached thousands of stars within days of the v0.1.1 release. Community contributions already target Windows support, additional ecosystems such as NuGet and Homebrew, and OSV.dev integration. Perplexity maintains curated exposure catalogs in the threat_intel directory, seeded with incidents including the XZ Utils backdoor and ongoing npm campaigns, and accepts community PRs.
Integration fits existing DevSecOps patterns. Security teams schedule baseline scans through fleet tools. Incident responders trigger deep scans when advisories drop. Solo developers and small teams run the zero-dependency Go binary directly. The Apache 2.0 license removes barriers for broad use.
Runtime and endpoint security now extend to the local developer surface. Tools that inventory on-disk state without execution give teams a practical way to answer the question that follows every supply-chain advisory: which machines carry the exposure right now.
WebProNews is an iEntry Publication