Bumblebee by Perplexity: How to Check if Your npm or pip Packages Are Compromised

A guide to using Perplexity’s open-source Bumblebee scanner to check your developer machine for known supply-chain threats, without ever running the packages themselves.

It was a Sunday night when the advisory landed in my inbox. A React utility with 12 million weekly downloads had been quietly poisoned since March. Somewhere between the changelog and the panic, one line stuck with me: the malicious code fired automatically on install, before anyone even noticed something was wrong.

I did what most developers do in that moment. I opened a terminal and typed npm ls package-name across half a dozen projects, trying to figure out if I was exposed. It wasn’t until I read further into the incident report that I realized how dumb that instinct actually was.

The Problem With Checking for a Poisoned Package

Here’s the uncomfortable truth about supply-chain attacks: the moment you install a poisoned npm or pip package, malicious postinstall scripts can run automatically, before you’ve written a single line of code that touches it. That’s how the worm spreads in the first place.

Which means the obvious way to check if you’re exposed, running npm ls, pip show, or go list against a suspect package, can actually be part of the problem. If checking your exposure means letting your package manager touch the compromised files again, you might be triggering the exact script you were trying to avoid.

This wasn’t a hypothetical for me anymore. On May 11, a group tracked by Google as UNC6780 had planted malicious code into more than 160 packages used by millions of developers, hitting libraries from Mistral AI, UiPath, and that React tool I mentioned. The campaign had reportedly been running since March, quietly, before anyone caught it.

I needed a way to check my machine that didn’t involve poking the thing I was scared of.

Enter Bumblebee

That’s when I came across Bumblebee, an open-source tool Perplexity released in May 2026 and had already been using internally to protect the developer machines behind Perplexity Search, the Comet browser, and its Computer agent.

The design philosophy is almost stubborn in its simplicity: never execute anything. Bumblebee doesn’t run your package manager. It doesn’t invoke npm, pnpm, Yarn, Bun, or pip. It doesn’t even read your actual source code. Instead, it reads metadata directly, lockfiles, manifests, and installed package records, and compares what it finds against a catalog of known-compromised packages, versions, extensions, or configs.

If an advisory names a specific poisoned version of a library, Bumblebee tells you whether that exact version currently sits on your machine’s disk. That’s the entire job. It doesn’t monitor your processes, it doesn’t watch your network traffic, and it makes no outbound connections while scanning. It’s not trying to be an EDR platform. It’s trying to answer one narrow, urgent question as safely and quickly as possible.

What It Actually Covers

What surprised me was how wide the scanning surface is for a tool that promises to touch almost nothing. Bumblebee checks across four surfaces in a single pass:

• Language package managers, including npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, and Composer
• MCP server configurations, relevant now that AI coding agents are a normal part of most workflows
• Editor extensions, across the VS Code family including Cursor, Windsurf, and VSCodium
• Browser extensions, for both Chromium-based browsers and Firefox

Most existing tools I’d used before only covered one or two of these at a time. Having all four checked in a single read-only sweep was the first time this felt like it matched how an actual developer machine looks, extensions installed on a whim, MCP configs from three different projects, half-remembered global npm packages from two years ago.

Running Your First Scan

Getting started is refreshingly plain. With Go 1.25 or later installed, you pull it straight from GitHub:

go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest
bumblebee scan --profile baseline

There are three scan profiles, and picking the right one matters depending on what you’re actually worried about:

• Baseline does a routine sweep of standard global roots, good for a regular check-in on your laptop
• Project targets a specific repo or workspace, useful when you’re auditing one codebase before a release
• Deep walks your entire home directory, which is what you reach for during an actual incident response

For that Sunday night scare, I ran a deep scan against a threat catalog built from the specific advisory I’d read:

bumblebee scan --profile deep \
  --root "$HOME" \
  --exposure-catalog ./threat_intel/advisory-2026-05.json \
  --findings-only

The output comes back as NDJSON, one finding per line, which made it trivial to pipe into a script and just check whether the line count was zero. It was. That was, genuinely, one of the more relieving terminal outputs I’ve seen in a while.

Why the “Never Execute Anything” Part Actually Matters

I’ll admit, the first time I read “it never runs npm or pip,” my instinct was to wonder how a scanner could possibly be thorough without actually running the tools it’s inspecting. But that skepticism faded once I understood the reasoning.

A scanner that has to invoke your package manager to check for a compromised package has already lost the argument. If the package manager triggers a postinstall script the moment it’s touched, and that’s exactly how modern supply-chain worms spread, then the scan itself becomes a vector for the attack. Bumblebee sidesteps this entirely by treating your package manager, and your source files, as things to read around, never through.

It’s written in pure Go with zero dependencies outside the standard library, which means the compiled binary is a single static file. No runtime dependencies to manage, no hidden third-party package that could itself become a weak link. For a tool whose entire job is trustworthiness during an active incident, that minimalism isn’t an accident. It’s the point.

Where This Fits Into Your Routine

Bumblebee is a one-shot scanner. Each run does a single scan and exits, it doesn’t sit in the background watching your system. That means the cadence is on you: a cron job for routine baseline checks, a step in CI for project-level scans, or an on-demand deep scan the moment a new advisory drops.

It doesn’t replace an SBOM tool that documents what’s in your production build, and it isn’t a substitute for actual endpoint detection software. What it fills is the messier, less-documented gap in between: the actual state of a developer’s laptop, half-forgotten global installs, browser extensions nobody remembers adding, MCP configs copied from three projects ago. That’s usually the part nobody audits until something goes wrong.

FAQ

Does Bumblebee ever read my actual source code?
No. It reads metadata only, lockfiles, manifests, and installed package records. It never parses or analyzes your application’s source files.

Can Bumblebee accidentally trigger a malicious postinstall script?
No, by design. It never invokes npm, pnpm, Bun, or pip, and never runs install scripts or lifecycle hooks, which is the exact mechanism most supply-chain worms rely on to spread.

Does it make any network calls during a scan?
No. Bumblebee makes zero network calls while scanning. Threat catalogs have to be distributed to your machine separately, through git, your endpoint management tooling, or a manual download.

What platforms does it support?
Official support is for macOS and Linux. There’s no announced timeline for Windows, though the pure Go codebase is technically cross-compilable.