
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@computesdk/workbench
Advanced tools
Interactive REPL for testing ComputeSDK sandbox operations with instant feedback and autocomplete.
@computesdk/cmd functions autocompletenpm.install('express') and it just runsnpm install -D @computesdk/workbench
# Install at least one provider
npm install @computesdk/e2b
# or any other provider
.env:# E2B Provider
E2B_API_KEY=e2b_your_api_key_here
# Daytona Provider
DAYTONA_API_KEY=your_daytona_api_key
npx workbench
workbench> npm.install('express')
⏳ Creating sandbox with e2b...
✅ Sandbox ready (1.2s)
Running: npm install express
✅ Completed (3.2s)
workbench> git.clone('https://github.com/user/repo')
Running: git clone https://github.com/user/repo
✅ Completed (2.1s)
workbench> ls('/home')
Running: ls /home
total 8
drwxr-xr-x 3 user user 4096 Dec 12 19:00 node_modules
drwxr-xr-x 2 user user 4096 Dec 12 19:01 repo
✅ Completed (0.1s)
provider <name> - Switch provider (e.g., provider e2b)providers - List all providers with statusrestart - Restart current sandboxdestroy - Destroy current sandboxinfo - Show sandbox info (provider, uptime)env - Show environment/credentials statushelp - Show this helpexit - Exit workbenchEach provider requires its package installed (e.g. @computesdk/e2b) and its credentials configured.
Just type any @computesdk/cmd function. Tab autocomplete works!
Package Managers:
npm.install('express')
npm.run('dev')
pnpm.install()
yarn.add('lodash')
pip.install('requests')
Git:
git.clone('https://...')
git.commit('Initial commit')
git.push()
Filesystem:
mkdir('/app/src')
ls('/home')
cat('/home/file.txt')
cp('/src', '/dest', { recursive: true })
rm('/file.txt') // Remove file
rm.rf('/directory') // Force remove anything
rm.auto('/path') // Smart remove (auto-detects file vs directory)
Network:
curl('https://api.example.com')
wget('https://file.com/download.zip')
And 100+ more! Press Tab to explore.
Switch between providers:
workbench> provider e2b
✅ Switched to e2b
workbench> npm.install('express')
⏳ Creating sandbox with e2b...
✅ Sandbox ready (1.2s)
Running: npm install express
✅ Completed (3.2s)
workbench> provider daytona
Destroy current sandbox? (y/N): y
✅ Switched to daytona
When you create a sandbox using create(), it automatically becomes your current active sandbox. All subsequent commands will run on this sandbox.
> create({ namespace: "h" })
✅ Switched to sandbox sandbox-123
{ sandboxId: 'sandbox-123', provider: 'e2b', metadata: {} }
e2b:sandbox-123> // Prompt shows you're now on this sandbox
> ls('/home') // Runs on sandbox-123
If you already have an active sandbox and create another one, the workbench will prompt you:
e2b:sandbox-456> create({ namespace: "prod" })
Switch to new sandbox? (Y/n): y
✅ Switched to sandbox sandbox-789
e2b:sandbox-789>
Press Enter or type "y" to switch. Type "n" to create the sandbox without switching to it.
Autocomplete works for all commands:
workbench> npm.<TAB>
install run init uninstall
workbench> git.<TAB>
add branch checkout clone commit diff fetch
init log pull push reset stash status
workbench> provider <TAB>
e2b daytona modal runloop vercel
Install any combination of:
@computesdk/e2b - E2B sandboxes@computesdk/daytona - Daytona workspaces@computesdk/modal - Modal containers@computesdk/runloop - Runloop instances@computesdk/vercel - Vercel functions@computesdk/cloudflare - Cloudflare Workers@computesdk/codesandbox - CodeSandbox boxes@computesdk/blaxel - Blaxel environments@computesdk/northflank - Northflank deployment servicesSet provider credentials in .env:
# E2B
E2B_API_KEY=e2b_xxx
# Daytona
DAYTONA_API_KEY=xxx
# Modal
MODAL_TOKEN_ID=xxx
MODAL_TOKEN_SECRET=xxx
# Runloop
RUNLOOP_API_KEY=xxx
# Vercel
VERCEL_TOKEN=xxx
VERCEL_TEAM_ID=xxx
VERCEL_PROJECT_ID=xxx
# Cloudflare
CLOUDFLARE_API_TOKEN=xxx
CLOUDFLARE_ACCOUNT_ID=xxx
# CodeSandbox
CSB_API_KEY=xxx
# Blaxel
BL_API_KEY=xxx
BL_WORKSPACE=xxx
# Northflank
NORTHFLANK_TOKEN=nf_xxx
NORTHFLANK_PROJECT_ID=my-project
NORTHFLANK_TEAM_ID=xxx # optional — required only for organization API tokens
NORTHFLANK_API_URL=xxx # optional — defaults to https://api.northflank.com
exit or .exit, optionally destroy sandboxenv to see which providers are configuredThe workbench is a full Node.js REPL with the ComputeSDK pre-loaded. You can reproduce any SDK test by calling the same methods interactively.
| SDK Test Code | Workbench Equivalent |
|---|---|
sandbox.runCommand('echo hi') | runCommand('echo hi') or getInstance().runCommand(...) |
sandbox.filesystem.readFile(path) | filesystem.readFile(path) |
sandbox.getInfo() | sandboxInfo() |
sandbox.getUrl({ port }) | getUrl({ port: 3000 }) |
If this test fails:
// From provider-compatibility.test.ts
it('command with streaming callbacks', async () => {
let stdoutCalled = false;
const result = await sandbox.runCommand('echo "hello"', {
onStdout: () => { stdoutCalled = true; },
});
expect(stdoutCalled).toBe(true);
});
Reproduce it in workbench:
> ls('/home') // Auto-creates sandbox
> const sandbox = getInstance()
> let stdoutCalled = false
> const result = await sandbox.runCommand('echo "hello"', {
onStdout: (data) => { console.log('STDOUT:', data); stdoutCalled = true }
})
> stdoutCalled // Should be true
> result
Enable verbose mode to see full response objects and WebSocket debug info:
> verbose() // Toggle on - shows full results and WebSocket frames
> ls('/home')
> verbose() // Toggle off
Prefix with $ to run shell commands directly (bypasses @computesdk/cmd):
> $echo "hello" | tr 'a-z' 'A-Z'
> $for i in 1 2 3; do echo $i; done
MIT
FAQs
Interactive REPL for testing ComputeSDK sandbox operations
The npm package @computesdk/workbench receives a total of 335 weekly downloads. As such, @computesdk/workbench popularity was classified as not popular.
We found that @computesdk/workbench demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.