An Update on Composer and Packagist Supply Chain Security(blog.packagist.com)

blog.packagist.com

An Update on Composer and Packagist Supply Chain Security

https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/

2 comments

I arrived at a similar model for NPM using hooks in pnpm: https://github.com/captn3m0/npm-sec-feed. I love the work Packagist/Composer is doing in the space.

I’m now a firm believer that every package manager needs to support hooks globally.

Composer also supports conflicts which results in this amazing approach of having a meta-package conflict with insecure packages: https://github.com/Roave/SecurityAdvisories.

Can’t happen in Node, sadly because of language differences.

moebrownehá 2 meses

I appreciate Composers slower but deliberate, well thought out approach to supply chain attack mitigations.