$ show perplexityai/bumblebee
Bumblebee is a production-grade supply-chain inventory collector for macOS and Linux developer endpoints. It scans the filesystem for package metadata from lockfiles (npm, pnpm, yarn, bun, gomod, rubygems, composer), install receipts (Homebrew, Python dist-info, Go sum), extension manifests (VS Code, browser extensions), and MCP configuration files. The system outputs NDJSON records of installed packages and can optionally match them against operator-supplied threat intelligence catalogs to emit findings for known malicious packages. It is a single Go binary with zero runtime dependencies, designed for offline, read-only operation. Architecturally, it follows a modular scanner pattern with a generic filesystem walker, per-ecosystem scanners, an exposure catalog loader, and a pluggable output sink (stdout, file, or HTTP with bearer/HMAC auth and gzip). The repository also includes a threat_intel directory of curated supply-chain attack data and a tool to convert OSV records into its catalog format. Although primarily an application, it has a strong data component through its structured threat intelligence catalogs, making it a hybrid that leans towards a security scanning tool.
The LLM identified 5 files worth highlighting for reuse:
A highly optimized, concurrent filesystem walker with pluggable exclude patterns, symlink loop detection, overlapping root deduplication, and configurable error handling. It has zero internal imports beyond the standard library, making it directly reusable in any Go project that needs to traverse directory trees with custom exclusion logic. Demonstrates non-obvious skill in handling platform-specific path comparisons and efficient goroutine dispatching.
A utility package that normalizes package names across multiple ecosystems (npm, PyPI, RubyGems, Go modules, Composer, Homebrew, etc.) using ecosystem-specific rules. It depends only on the standard library (strings, unicode) and is thoroughly tested. Can be extracted and reused for any tool that needs canonical package name matching or deduplication.
An HTTP output sink that sends batched NDJSON payloads with optional bearer token or HMAC-SHA256 request signing and gzip compression. It manages concurrency, retries, and backpressure. The pattern is self-contained and could be reused for any pipeline that requires authenticated, batched data submission to a REST endpoint.
An MCP (Model Context Protocol) configuration scanner that parses JSON configs, infers package manager launchers from install arguments (npx, uvx, docker, pipx, etc.), and sanitizes package specifications from URLs, file paths, and image references. It includes reusable utilities like looksLikePackageSpec, splitDockerImageRef, and sanitizeRemoteURL that solve complex parsing problems common in developer tool dependency extraction.
A custom line-oriented parser for pnpm lockfiles (versions 5, 6, 9) that avoids external YAML libraries by implementing indentation-based parsing. It correctly handles scoped package names, peer dependency suffixes, and store-layout package resolution. Demonstrates non-obvious skill in parsing a complex format without dependencies, and the pattern (size-limited reader, state-machine parsing) is applicable to other lockfile formats.