Perplexity open-sources Bumblebee security scanner

Perplexity is releasing Bumblebee, an open-source security scanner for developer machines, and making an internal supply-chain response tool publicly available. The tool is built for macOS and Linux and is designed to scan local developer environments for risky packages, browser extensions, editor extensions, and AI tool configurations without modifying the machine.

Bumblebee focuses on a specific security problem: when a new compromised package, extension, or developer tool risk appears, teams need to know which machines may be exposed right now. Instead of checking only shipped software via SBOMs or runtime behavior via EDR tools, Bumblebee reads local metadata from lockfiles, package manager records, extension manifests, and supported MCP configuration files. It then emits structured NDJSON records that security teams can compare against exposure catalogs.

The scanner covers common developer ecosystems, including:

1. npm, pnpm, Yarn, Bun
2. PyPI
3. Go modules
4. RubyGems
5. Composer
6. VS Code-family editor extensions such as Cursor, Windsurf, and…