
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@computesdk/daytona
Advanced tools
Daytona provider for ComputeSDK - standardized development environments with devcontainer support
Daytona provider for ComputeSDK - Execute code in Daytona development workspaces.
npm install @computesdk/daytona
Use the gateway for zero-config auto-detection:
import { compute } from 'computesdk';
// Auto-detects Daytona from DAYTONA_API_KEY environment variable
const sandbox = await compute.sandbox.create();
// Execute code
const result = await sandbox.runCommand('python -c "print(\"Hello from Daytona!\")"');
console.log(result.stdout); // "Hello from Daytona!"
await sandbox.destroy();
For direct SDK usage without the gateway:
import { daytona } from '@computesdk/daytona';
const compute = daytona({
apiKey: process.env.DAYTONA_API_KEY
});
const sandbox = await compute.sandbox.create();
const result = await sandbox.runCommand('python -c "print(\"Hello from Daytona!\")"');
console.log(result.stdout);
await sandbox.destroy();
export DAYTONA_API_KEY=your_api_key_here
interface DaytonaConfig {
/** Daytona API key - if not provided, will use DAYTONA_API_KEY env var */
apiKey?: string;
/** Default runtime environment */
runtime?: 'python' | 'node';
/** Execution timeout in milliseconds */
timeout?: number;
}
// Execute Python code
const result = await sandbox.runCommand(`python - <<'PY'
import json
data = {"message": "Hello from Python"}
print(json.dumps(data))
PY`);
// Execute Node.js code
const result = await sandbox.runCommand(`node - <<'JS'
const data = { message: "Hello from Node.js" };
console.log(JSON.stringify(data));
JS`);
// Auto-detection (based on code patterns)
const result = await sandbox.runCommand('python -c "print(\"Auto-detected as Python\")"');
// List files
const result = await sandbox.runCommand('ls', ['-la']);
// Install packages
const result = await sandbox.runCommand('pip', ['install', 'requests']);
// Run scripts
const result = await sandbox.runCommand('python', ['script.py']);
// Write file
await sandbox.filesystem.writeFile('/workspace/hello.py', 'print("Hello World")');
// Read file
const content = await sandbox.filesystem.readFile('/workspace/hello.py');
// Create directory
await sandbox.filesystem.mkdir('/workspace/data');
// List directory contents
const files = await sandbox.filesystem.readdir('/workspace');
// Check if file exists
const exists = await sandbox.filesystem.exists('/workspace/hello.py');
// Remove file or directory
await sandbox.filesystem.remove('/workspace/hello.py');
// Get sandbox info
const info = await sandbox.getInfo();
console.log(info.id, info.provider, info.status);
// List all sandboxes
const sandboxes = await compute.sandbox.list(provider);
// Get existing sandbox
const existing = await compute.sandbox.getById(provider, 'sandbox-id');
// Destroy sandbox
await compute.sandbox.destroy(provider, 'sandbox-id');
The provider automatically detects the runtime based on code patterns:
Python indicators:
print( statementsimport statementsdef function definitionsf", __, etc.)Default: Node.js for all other cases
import { daytona } from '@computesdk/daytona';
try {
const compute = daytona({ apiKey: process.env.DAYTONA_API_KEY });
const sandbox = await compute.sandbox.create();
const result = await sandbox.runCommand('invalid code');
} catch (error) {
if (error.message.includes('Syntax error')) {
console.error('Code has syntax errors');
} else if (error.message.includes('authentication failed')) {
console.error('Check your DAYTONA_API_KEY');
} else if (error.message.includes('quota exceeded')) {
console.error('Daytona usage limits reached');
}
}
import { daytona } from '@computesdk/daytona';
const compute = daytona({ apiKey: process.env.DAYTONA_API_KEY });
const sandbox = await compute.sandbox.create();
const result = await sandbox.runCommand(`python - <<'PY'
import json
# Process data
data = [1, 2, 3, 4, 5]
result = {
"sum": sum(data),
"average": sum(data) / len(data),
"max": max(data)
}
print(json.dumps(result))
PY`);
const output = JSON.parse(result.stdout);
console.log(output); // { sum: 15, average: 3, max: 5 }
await sandbox.destroy();
import { daytona } from '@computesdk/daytona';
const compute = daytona({ apiKey: process.env.DAYTONA_API_KEY });
const sandbox = await compute.sandbox.create();
// Create data file
await sandbox.filesystem.writeFile('/workspace/data.json',
JSON.stringify({ users: ['Alice', 'Bob', 'Charlie'] })
);
// Process file
const result = await sandbox.runCommand(`python - <<'PY'
import json
with open('/workspace/data.json', 'r') as f:
data = json.load(f)
# Process users
user_count = len(data['users'])
print(f"Found {user_count} users")
# Save result
result = {"user_count": user_count, "processed": True}
with open('/workspace/result.json', 'w') as f:
json.dump(result, f)
PY`);
// Read result
const resultData = await sandbox.filesystem.readFile('/workspace/result.json');
console.log(JSON.parse(resultData));
await sandbox.destroy();
MIT
FAQs
Daytona provider for ComputeSDK - standardized development environments with devcontainer support
The npm package @computesdk/daytona receives a total of 776 weekly downloads. As such, @computesdk/daytona popularity was classified as not popular.
We found that @computesdk/daytona demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.