GitHub - perplexityai/bumblebee: Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.

Bumblebee is a read-only inventory collector for package, extension, and developer-tool metadata on macOS and Linux developer endpoints. It answers a narrow supply-chain response question: when an advisory names a package, extension, or version, which developer machines show a match in their on-disk metadata right now? SBOMs help answer what shipped, and EDR helps answer what ran or touched the ne

[tmatsuu]

各種パッケージシステムの依存関係などのmetadataを収集するツール。SBOMで管理できない範囲を扱うためかな。npm系、pypi、go、rubygems、composerなどの言語系のほか、mcp、vscode拡張、ブラウザ拡張、homebrewにも対応。