perplexityai/bumblebeeRead-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.
Maintained exposure catalogs for recent supply-chain campaigns, built from public threat-intelligence reporting with Perplexity Computer and updated via PRs as fresh campaigns are reported.
Pass a catalog to a scan with --exposure-catalog <path>. Review
the entries against current advisories before production use.
| File | Campaign | Source |
|---|---|---|
tensorlake-2026-10-08.json | ChainDrop / Shai-Hulud npm supply-chain compromise of tensorlake (1 malicious version, 0.5.144, published 2026-10-08; preinstall hook runs obfuscated lib/setup.mjs loader and lib/Math_Symbol.js credential-stealing, self-propagating worm payload) | Socket, 2026-10-08 |
memtensor-2026-09-23.json | MemTensor npm and PyPI credential-stealer compromise (2 packages / 4 malicious versions) | Socket, 2026-09-23 |
openapi-react-query-codegen-2026-08-28.json | Mini Shai-Hulud npm supply-chain compromise of @7nohe/openapi-react-query-codegen (10 malicious versions published 2026-08-28 across every maintained release line via a comment-triggered GitHub Actions publishing workflow; obfuscated binding.gyp/preinstall loader targets cloud, npm, GitHub Actions, and AI agent secrets with self-propagation) | Socket, 2026-08-28 |
mastra-2026-06-17.json | Mastra npm supply-chain compromise (141 packages / 141 versions across @mastra/* plus create-mastra and the [email protected] typosquat dependency that delivered a cross-platform infostealer via postinstall) | Socket, 2026-06-17 |
mini-shai-hulud-leoplatform-2026-06-24.json | Mini Shai-Hulud / Miasma (Hades variant) LeoPlatform/RStreams wave (compromised czirker npm account; 26 npm packages + 1 Go module / 27 versions; "Phantom Gyp" binding.gyp install hook, Bun-staged infostealer, "Alright Lets See If This Works" dead-drop marker) | Socket, 2026-06-24; OX Security, 2026-06-24 |
mini-shai-hulud.json | Mini/Shai-Hulud May 2026 npm and PyPI compromise (OX Security affected-package table) | Cross-checked against Fleet, Socket, Snyk, Mistral, TanStack, The Hacker News |
mini-shai-hulud-redhat-cloud-services.json | Mini Shai-Hulud compromise of Red Hat Cloud Services (@redhat-cloud-services) npm packages (32 packages / 95 versions; "Miasma: The Spreading Blight" worm marker) | Socket, 2026-06-01 |
laravel-lang-2026-05-23.json | Laravel Lang Composer/Packagist supply-chain compromise across laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions | Socket, 2026-05-23 |
nx-console-vscode-2026-05-18.json | Nx Console VS Code extension (nrwl.angular-console 18.95.0) compromise published to the VS Code Marketplace on 2026-05-18 (OpenVSX unaffected; remediated in 18.100.0+) | StepSecurity, 2026-05-18 |
antv-mini-shai-hulud.json | AntV / Mini Shai-Hulud May 2026 npm worm wave (324 packages / 643 versions across npm and PyPI; scoped to artifacts detected on or after 2026-05-13) | Socket, 2026-05-19 |
node-ipc-credential-stealer.json | node-ipc npm 2026-05 credential-stealer compromise (7 malicious versions) | Socket, 2026-05-14 |
shopsprint-decimal-typosquat.json | Go github.com/shopsprint/decimal v1.3.3 typosquat with DNS TXT backdoor | Socket, 2026-05-19 |
gemstuffer.json | GemStuffer RubyGems exfiltration campaign (123 gems / 155 versions) targeting UK local government | Socket, 2026-05-13 |
glassworm.json | GlassWorm self-propagating IDE-extension worm on Open VSX / VS Code (invisible-Unicode loader, transitive extensionPack/Dependencies delivery, Solana memo C2, credential/wallet theft); 243 editor-extension packages / 381 versions + 2 npm packages / 2 versions (245 entries / 383 versions) | Socket GlassWorm v2 campaign CSV and Socket transitive report, 2026-03-13; supplemented by Koi Security, 2025-10-18, Checkmarx, 2026-03, and Sonatype, 2026-03-17 |
trapdoor-crypto-stealer.json | TrapDoor Crypto Stealer cross-ecosystem credential/wallet stealer across npm, PyPI, and Cargo/Crates.io (28 npm/PyPI entries / 378 versions; 6 Cargo packages documented under _cargo_packages, not matched until Cargo support lands) | Socket, 2026-05-24 |
tools/osvcatalog converts a local OSV snapshot into
a catalog offline. Bumblebee never queries osv.dev at scan time. Only
malicious-package records (MAL- ids, or records aliased to one) are
emitted, with severity: "critical".
Two input shapes are supported. Pick one based on coverage.
OSSF malicious-packages repo (recommended, all ecosystems in one tree):
git clone --filter=blob:none --sparse --depth=1 \
https://github.com/ossf/malicious-packages.git mp
git -C mp sparse-checkout set osv/malicious
go run ./tools/osvcatalog \
-source "https://github.com/ossf/malicious-packages@$(git -C mp rev-parse HEAD)" \
-o threat_intel/osv-malicious.json mp/osv/malicious/
OSV per-ecosystem dump (single ecosystem, zip archive):