@computesdk/docker
Docker provider for ComputeSDK - local containerized sandboxes for development and testing
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:dockerode | AI (phantom-deps): Bundled dist package; imports resolved at build time, not directly visible as top-level imports. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common (~88% of npm); no other risk signals present for this package. | ai | |
| dependencies | unvetted-dep:computesdk | AI (dependencies): computesdk is the first-party core package from the same org/monorepo; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:computesdk | AI (phantom-deps): computesdk is a peer/config dependency in a monorepo; not directly imported by design. | ai |
Versions (showing 51 of 62)
| Version | Deps | Published |
|---|---|---|
| 1.2.49 | 3 / 9 | |
| 1.2.48 | 3 / 9 | |
| 1.2.47 | 3 / 9 | |
| 1.2.46 | 3 / 9 | |
| 1.2.45 | 3 / 9 | |
| 1.2.44 | 3 / 9 | |
| 1.2.43 | 3 / 9 | |
| 1.2.42 | 3 / 9 | |
| 1.2.41 | 3 / 9 | |
| 1.2.40 | 2 / 9 | |
| 1.2.39 | 2 / 9 | |
| 1.2.38 | 2 / 9 | |
| 1.2.37 | 2 / 9 | |
| 1.2.36 | 2 / 9 | |
| 1.2.35 | 2 / 9 | |
| 1.2.34 | 2 / 9 | |
| 1.2.33 | 2 / 9 | |
| 1.2.32 | 2 / 9 | |
| 1.2.31 | 2 / 9 | |
| 1.2.30 | 2 / 9 | |
| 1.2.28 | 2 / 9 | |
| 1.2.27 | 2 / 9 | |
| 1.2.25 | 2 / 9 | |
| 1.2.24 | 2 / 9 | |
| 1.2.23 | 2 / 9 | |
| 1.2.22 | 2 / 9 | |
| 1.2.21 | 2 / 9 | |
| 1.2.20 | 2 / 9 | |
| 1.2.19 | 2 / 9 | |
| 1.2.18 | 2 / 9 | |
| 1.2.17 | 2 / 9 | |
| 1.2.16 | 2 / 9 | |
| 1.2.14 | 2 / 9 | |
| 1.2.13 | 2 / 9 | |
| 1.2.12 | 2 / 9 | |
| 1.2.11 | 2 / 9 | |
| 1.2.10 | 2 / 9 | |
| 1.2.9 | 2 / 9 | |
| 1.2.8 | 2 / 9 | |
| 1.2.7 | 2 / 9 | |
| 1.2.6 | 2 / 9 | |
| 1.2.5 | 2 / 9 | |
| 1.2.4 | 2 / 9 | |
| 1.2.3 | 2 / 9 | |
| 1.2.2 | 2 / 9 | |
| 1.2.1 | 2 / 9 | |
| 1.2.0 | 2 / 9 | |
| 1.1.8 | 2 / 9 | |
| 1.1.7 | 2 / 9 | |
| 1.1.6 | 2 / 9 | |
| 1.1.5 | 2 / 9 |
v1.2.49
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (heygarrison) on 2026-05-29, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.