composer-cve-gate: Pre-installation Security Plugin for CVE Scanning and Malicious Package Blocking

composer-cve-gate Project Summary Vulnerability Overview The project is a pre-install security plugin for Composer. It aims to address the security blind spot in Composer that exists after dependency packages are downloaded but before they are installed (before post-install scripts run). Key features include: 1. CVE Scanning: Checks dependencies for known vulnerabilities before the code touches the machine, using data sources like OSV.dev, GitHub Advisory Database, and NIST NVD. 2. Malicious Package Blocking: Intercepts packages containing malicious code (e.g., backdoors, credential theft). 3. Freshness Control: Blocks packages published less than 3 days ago to prevent exploitation of newly released vulnerabilities (Typoquatting or zero-day attacks). Impact Scope Affected Components: All PHP projects using Composer for dependency management. Risk Scenarios: Malicious packages executing arbitrary code in scripts (e.g., installing backdoors, stealing credentials). Dependency packages with known CVE vulnerabilities. Dependency packages that are newly released malicious packages (not yet indexed by traditional vulnerability databases). Supported Environments: Composer 2.x PHP 8.2+ Python 3.11+ (for running the underlying scanner) Remediation and Usage Guide 1. Install the Plugin Run the following command in the project root directory to install the plugin: 2. Securely Install New Packages Use the command instead of the standard or . This command scans the dependency tree first and only proceeds with installation if it's safe. Success Output: Displays the scanning process and proceeds with installation if no issues are found. Failure Output: If vulnerabilities or malicious packages are found, it outputs a message and prevents installation, with an exit code of 1. 3. Securely Upgrade Dependencies Use the command instead of . 4. Scan Installed Dependencies Use the command to check if packages already present in the current directory contain malicious code or vulnerabilities. This command does not modify or download anything; it performs a read-only scan. Output results are categorized into three types: : No findings. : Vulnerability database match found, but no malicious code indicators. : Malicious code strings or marker files found. 5. Exit Code Meanings safe-install / safe-upgrade: : Scan passed, installation successful. : Vulnerability or malicious package found, installation blocked. : Scanner error (e.g., missing Python). safe-scan: : Clean. : Infection found (Infected). : Suspicious. : Scanner error. 6. Handling Blocked Packages If blocks a package, you can take the following actions: Specify Version: Manually specify a known safe version. Disable Freshness Check: If the block was due to the package being too new (Freshness Hold) and you trust the package, you can disable this check. 7. For DDEV Users If using DDEV (for Drupal, Laravel, Symfony, etc.), it is recommended to install the DDEV plugin version. It scans inside the container against the container's PHP version for more accuracy. Then use commands like . Related Projects : Blocks installation of Claude Code. : Blocks installation of Mistral Code. : A safe upgrade tool for Homebrew.

Goal Reached Thanks to every supporter — we hit 100%!

composer-cve-gate: Pre-installation Security Plugin for CVE Scanning and Malicious Package Blocking

More from this source