Bumblebee

Open-source scanner that checks developer laptops for risky packages, extensions, and AI tool configs without triggering anything malicious.

Covers npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer, MCP server configs, editor extensions, and browser extensions
Three scan profiles: baseline for routine checks, project for specific repos, deep for active incident response
Read-only by design: never runs install scripts, package managers, or lifecycle hooks, so scanning a compromised machine cannot trigger the attack
Written in Go with zero non-stdlib dependencies and published as free open source on GitHub

Security and platform teams who need to know which developer laptops have vulnerable packages installed

A supply-chain compromise drops and you need to sweep every developer machine fast without triggering the attack itself

Security teams and platform engineers responsible for endpoint exposure during incidents

Staying informed is great. Staying ahead is better.

Pick a topic and leave with something you created.

Get new module drops and weekly AI strategy.