
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@computesdk/cmd
Advanced tools
Type-safe shell command builders for use with ComputeSDK sandboxes.
npm install @computesdk/cmd
import { cmd, npm, node, git } from '@computesdk/cmd';
// Build command tuples
npm.install('express') // ['npm', 'install', 'express']
node('server.js') // ['node', 'server.js']
git.clone('https://...') // ['git', 'clone', 'https://...']
// Use with sandbox.runCommand()
await sandbox.runCommand(npm.install('express'));
await sandbox.runCommand(node('server.js'));
Modern ComputeSDK sandboxes handle cwd, env, and background options directly:
import { npm, node } from '@computesdk/cmd';
// Let the sandbox handle execution options
await sandbox.runCommand('npm install', { cwd: '/app' })
await sandbox.runCommand('node server.js', { background: true })
await sandbox.runCommand('npm run dev', {
cwd: '/app',
background: true,
env: { NODE_ENV: 'production' }
})
For cases where you need explicit shell wrapping, use shell(), sh(), bash(), or zsh():
import { shell, bash, zsh, npm } from '@computesdk/cmd';
// Default shell wrapper (sh)
shell(npm.install(), { cwd: '/app' })
// => ['sh', '-c', 'cd "/app" && npm install']
// Bash-specific
bash(npm.install(), { cwd: '/app' })
// => ['bash', '-c', 'cd "/app" && npm install']
// Zsh with background
zsh(npm.run('dev'), { background: true })
// => ['zsh', '-c', 'nohup npm run dev > /dev/null 2>&1 &']
Note: Shell wrapping is rarely needed - prefer using runCommand() options instead.
mkdir(path, options?) - Create directory (recursive by default)rm(path, options?) - Remove file/directorycp(src, dest, options?) - Copymv(src, dest) - Move/renamels(path?, options?) - List directorypwd() - Print working directorychmod(mode, path, options?) - Change permissionschown(owner, path, options?) - Change ownertouch(path) - Create file/update timestampcat(path) - Read fileln(target, link, options?) - Create linkreadlink(path, options?) - Resolve symlinkrsync(src, dest, options?) - Sync files/directoriestest.exists(path) - File/dir existstest.isFile(path) - Is a filetest.isDir(path) - Is a directorytest.isReadable(path) - Is readabletest.isWritable(path) - Is writabletest.isExecutable(path) - Is executabletest.notEmpty(path) - File is not emptytest.isSymlink(path) - Is a symlinknode(script, args?) - Run Node.js scriptpython(script, args?) - Run Python scriptkill(pid, signal?) - Kill process by PIDpkill(name, options?) - Kill by nameps(options?) - List processestimeout(seconds, command, args?) - Run with timeoutnpm.install(pkg?, options?), npm.run(script), npm.init(), npm.uninstall(pkg)pnpm.install(pkg?, options?), pnpm.run(script)yarn.install(), yarn.add(pkg, options?), yarn.run(script)bun.install(pkg?, options?), bun.run(script), bun.exec(file)deno.run(file, options?), deno.install(url, options?)pip.install(pkg), pip.uninstall(pkg)uv.install(pkg), uv.run(script), uv.sync(), uv.venv(path?)poetry.install(options?), poetry.add(pkg, options?), poetry.run(cmd), poetry.build()pipx.install(pkg), pipx.run(pkg, args?), pipx.uninstall(pkg), pipx.upgrade(pkg)npx(pkg, args?) - Run with npxnpx.concurrently(commands, options?) - Run commands in parallelbunx(pkg, args?) - Run with bunxbunx.concurrently(commands, options?)git.init() - Initialize repositorygit.clone(url, options?) - Clone repositorygit.add(path, options?) - Stage filesgit.commit(message, options?) - Commit changesgit.push(options?) - Push to remotegit.pull() - Pull changesgit.fetch(options?) - Fetch from remotegit.checkout(branch, options?) - Checkout branchgit.branch(name?, options?) - List/create branchesgit.status() - Show statusgit.diff(options?) - Show changesgit.log(options?) - Show commit historygit.stash(options?) - Stash changesgit.reset(options?) - Reset changescurl(url, options?) - Download with curlwget(url, options?) - Download with wgetnet.ping(host, count?) - Ping hostnet.check(host, port) - Check connectivitynet.publicIp() - Get public IPnet.interfaces() - Show network interfacesport.find(port) - Find process using portport.kill(port) - Kill process on portport.isUsed(port) - Check if port is in useport.list() - List listening portsport.waitFor(port, timeout?) - Wait for porttar.extract(file, options?) - Extract tar archivetar.create(output, source) - Create tar archiveunzip(file, options?) - Extract zip archivegrep(pattern, file?, options?) - Search for patternsed(expression, file, options?) - Stream editorawk(program, file?, options?) - Pattern scanninghead(file, lines?) - First lines of filetail(file, lines?, options?) - Last lines of filewc(file, options?) - Word/line countsort(file, options?) - Sort linesuniq(file, options?) - Filter duplicatesjq(filter, file?, options?) - Process JSONcut(file, options) - Extract columnstr(set1, set2?, options?) - Translate charactersxargs(command, args?, options?) - Build commands from stdindf(path?, options?) - Disk spacedu(path, options?) - Directory sizewhoami() - Current useruname(options?) - System infohostname() - Hostnameenv() - Environment variablesprintenv(name?) - Print env variablewhich(command) - Find command locationbase64.encode(file?) - Encode to base64base64.decode(file?) - Decode from base64md5sum(file, options?) - MD5 checksumsha256sum(file, options?) - SHA256 checksumsha1sum(file, options?) - SHA1 checksumsleep(seconds) - Delay executiondate(format?) - Print date/timefind(path, options?) - Find filestee(file, options?) - Write to file and stdoutdiff(file1, file2, options?) - Compare filesecho(text) - Print textparallel(commands, options?) - Run commands in parallelraw(command, args?) - Custom commandesc(string)Escape double quotes in strings for shell safety:
import { esc } from '@computesdk/cmd';
esc('path with "quotes"') // 'path with \\"quotes\\"'
MIT
FAQs
Type-safe shell command builders for ComputeSDK sandboxes
The npm package @computesdk/cmd receives a total of 2,409 weekly downloads. As such, @computesdk/cmd popularity was classified as popular.
We found that @computesdk/cmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.