Perplexity AI has open-sourced an internal security scanner called Bumblebee that helps security teams quickly assess risk exposure on developer terminals when a software supply chain poisoning incident hits. Designed for macOS and Linux, this read-only asset collector inventories dependency lock files, package manager metadata, editor plugins, and AI tool configurations on local disk in seconds.
Unlike traditional detection tools that execute scan commands, Bumblebee uses a purely "read-only parsing" mechanism. It only parses dependency configuration files — it never runs package manager commands or reads any source code. This read-only approach fundamentally avoids the risk of triggering malicious package install scripts (like postinstall lifecycle hooks) during the scan itself, ensuring the detection process is completely safe.
To match different inventory frequencies and scopes, Bumblebee offers three scan profiles: baseline, project, and deep. Baseline scans global toolchains, editor plugins, and MCP server configurations; project focuses on a specific workspace directory; deep performs a full-disk scan for emergency investigations. It already supports extracting dependency information from over a dozen ecosystems including npm, PyPI, Go modules, and major browser extensions.
Inside Perplexity, Bumblebee is integrated into a supply chain threat defense pipeline built with Perplexity Computer and Comet. When a security team tracks a new vulnerability and generates a risk list, Bumblebee is automatically pushed to endpoints, confirming affected devices in seconds. Bumblebee is now open source on GitHub under the Apache License 2.0, with version 0.1.1 available for enterprise security teams to deploy quickly.