Bumblebee by Perplexity: How to Scan Your npm Packages for Malicious Code

If you type npm install next, you aren't just downloading Next.js. You are downloading Next.js, and the 500 dependencies it relies on, and the 2,000 dependencies those packages rely on.

Your node_modules folder is a black box containing gigabytes of JavaScript written by strangers. And increasingly, hackers are exploiting this. They buy popular but abandoned npm packages, publish a minor update containing obfuscated malware, and wait for thousands of developers to blindly run npm update.

Standard antivirus software won't catch it, because it looks like normal JavaScript.

Enter Bumblebee.

Bumblebee is a new, free developer tool released by the AI search company Perplexity.

Instead of relying on outdated signature-based scanning, Bumblebee uses Large Language Models specifically trained on cybersecurity to read the actual source code of your dependencies. It looks for behavioral anomalies—like a UI button library suddenly trying to access your ~/.ssh directory, or a math library trying to open an outbound network connection to a Russian IP address.

Perplexity made Bumblebee incredibly easy to integrate into your workflow. It runs entirely via the command line.

First, install it globally via npm:

npm install -g @perplexity/bumblebee

Navigate to any existing Node.js or React project on your computer, and simply run:

bumblebee scan

When you run the scan, Bumblebee doesn't just upload your entire codebase to Perplexity (which would be a massive privacy violation).

Instead, it uses a local heuristic engine to filter out 99% of normal code. It only flags highly suspicious code blocks—like heavy base64 obfuscation, dynamic eval() calls, or filesystem access in frontend packages.

Only those highly suspicious snippets are sent to Perplexity's backend LLM, which acts as a Senior Security Researcher. The LLM analyzes the snippet in context and returns a verdict.

Within about 30 seconds, Bumblebee outputs a terminal report.

If your project is safe, you get a green checkmark. But if it finds something, it gives you a terrifyingly detailed explanation.

For example, during a test, it flagged a package called colors-cli-util. The AI output explained: "High Risk: This package claims to be a terminal color formatter, but line 42 contains an obfuscated payload that executes a shell command to read environment variables and HTTP POST them to an external domain."

It then provided the exact file path so I could go delete it.

The best way to use Bumblebee is to not rely on human memory. You can add it directly to your GitHub Actions or GitLab CI pipeline.

By adding bumblebee scan --ci to your pre-build step, the build will automatically fail if the AI detects a supply chain attack in a newly added dependency.

As hackers get smarter and use AI to write malware, we have to use AI to defend against it. Bumblebee is the first tool that brings AI-powered security auditing to the everyday developer for free. Add it to your global workflow today.