https://www.drmhse.com/tags/supply-chain-security/Recent content in Supply-Chain-Security on DRM HSEHugoenWed, 15 Jul 2026 12:13:23 +0300https://www.drmhse.com/posts/bringing-a-face-to-the-buzz-why-i-built-a-ui-for-perplexity-bumblebee-scanner/Sun, 24 May 2026 19:36:43 +0300https://www.drmhse.com/posts/bringing-a-face-to-the-buzz-why-i-built-a-ui-for-perplexity-bumblebee-scanner/<p>When an advisory names a compromised package or editor extension, the immediate question is not abstract: is that exact package and version on this machine?</p> <p><a href="https://github.com/perplexityai/bumblebee"target="_blank" rel="noopener noreferrer" class="external-link">Perplexity&rsquo;s Bumblebee scanner<svg class="inline-block w-3 h-3 ml-0.5 align-baseline" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"> <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"></path> </svg> </a> answers that question by reading package-manager metadata, lockfiles, extension manifests, and supported developer-tool configurations on macOS and Linux. It does not execute package managers or inspect source files. It emits the inventory, diagnostics, scan summary, and any exact matches against a supplied exposure catalog as NDJSON.</p>