Bumblebee: Open-Source Supply Chain Security Scanner for Developer Machines

Bumblebee is a read-only, open-source supply chain security scanner that checks developer laptops for risky packages, editor extensions, browser extensions, and AI agent configs — without ever running a package manager or executing code.

In this video I cover:
• What supply chain attacks on developer machines look like
• How Bumblebee scans npm, PyPI, Go, RubyGems, MCP configs, VS Code & browser extensions
• The 3 scan profiles: baseline, project, and deep
• How to install, run a self-test, and scan your machine in under 2 minutes
• The structured NDJSON output and exposure catalog format

━━━━━━━━━━━━━━━━━━━━━━

🔗 GitHub Repo
https://github.com/perplexityai/bumblebee

📦 Install (requires Go 1.25+)
go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest

✅ Self-test
bumblebee selftest

🔍 Baseline scan
bumblebee scan - profile baseline - inventory.ndjson

━━━━━━━━━━━━━━━━━━━━━━

📄 License: Apache 2.0
🖥️ Platforms: macOS & Linux
⚙️ Built with: Go 1.25+, zero non-stdlib dependencies

━━━━━━━━━━━━━━━━━━━━━━

Видео Bumblebee: Open-Source Supply Chain Security Scanner for Developer Machines канала MadushanX