Composer 2.11 can delay compromised package releases — and urgent security fixes
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Search
Search results for “Packagist cooldown”
Find published research by company, product, platform or technology.
Showing 1–3 of 3 dossiers
Web DevelopmentMarketing & DistributionWordPressDeveloper ToolsMarketplaces & PlatformsActive dossier
WordPress.org can now stop high-risk plugin updates before they reach sites
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
Trail of Bits tests 25 package managers: most do not verify every download by default
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.