Bumblebee scans a dev machine's installed packages and editor extensions against known-compromised catalogs, catching supply-chain risk on the workstation.
Yes, Bumblebee is open source under the Apache-2.0 license.
Bumblebee is free to use.
Yes, Bumblebee can be self-hosted (the source is available under the Apache-2.0 license).
Apache-2.0 Go tool from Perplexity that inventories the packages and editor/agent extensions on a developer machine and checks them against catalogs of known-compromised software, moving supply-chain detection to the workstation instead of waiting for it to reach production. It ships as a single static binary with zero non-stdlib dependencies, installs with go install, and runs locally; the compromised-software catalogs are bundled.
The GTM stack is now half open-source packages and half IDE and agent extensions, and the last few months have shown how a single poisoned npm package or editor extension quietly turns into stolen tokens. Bumblebee is the cheap, local first check: point it at a machine, get back a list of anything on it that matches a known-compromised catalog. For a team without a security hire, that is a real gap filled with one static binary and no service to run. The honest read is that it only knows what is catalogued — so it is triage, not proof of safety — and its usefulness tracks how current the bundled lists are. As a workstation-level tripwire for the supply-chain attacks this registry keeps flagging, it earns its place.