Nils Adermann

Co-Founder of @packagist / and Co-Creator of #composerphp - he/him - @[e-mail]

[Jordi Boggiano @seldaek]

Ever found yourself accidentally merging changes to the public API of a PHP package and regretting it later? I made a GitHub Action to help prevent that. https://t.co/RRyKmcWDnv

[Packagist @packagist]

The Composer CLI is part of your supply chain. Older versions miss the protections in 2.10 and carry known CVEs of their own.

Private Packagist customers can now enforce which Composer client versions can talk to their repository.

#php #phpc #composerphp

[Nils Adermann @naderman]

@oliverheck @enunomaduro @AikidoSecurity @packagist Sorry I don't understand your question? The attack vector this protects from is a malicious actor having access to the GitHub repository, so they can typically modify anything there.

[Nils Adermann @naderman]

@oliverheck @enunomaduro @AikidoSecurity @packagist This is pointless right now as an attacker can control the release datetime in the package metadata. That's why we haven't shipped it in Composer yet. It'll become a config dependency policy in Composer as soon as we've addressed this on https://t.co/l9IV7RsqmV.

[Nils Adermann @naderman]

@enunomaduro @AikidoSecurity @packagist Not possible in the current architecture. So something we'll consider after rebuilding the entire publication process for staged releases. But got to keep the risks and trade offs in mind. What if aikido.has an outage for example.

[Pushpak @pushpak1300]

php devs, we no longer need to duct-tape python scripts just to parse a pdf 😭

launching Parsel: a fast memory efficient local document parser for PHP.

pdfs, office docs & images → text, structured data, bboxes, screenshots.

built for AI/RAG, NLP, invoices, search, and messy docs.

composer require shipfastlabs/parsel

[nunomaduro @enunomaduro]

confirmed… next week i'll be chatting irl on stream with @naderman, co-creator of composer, about everything the composer team is doing in light of the recent supply chain attacks

[Packagist @packagist]

⛔ Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp

[Packagist @packagist]

🛡️ Composer's download fallbacks can silently undermine repository security: A Private Packagist URL blocked for a malware-flagged version falls back to GitHub or a source clone.
Two new Private Packagist options close it off.
#php #phpc #composerphp

[Jordi Boggiano @seldaek]

I realized I was never going to get to adding zizmor to all my repos so I made a claude skill to let it do the grunt work.

You can use it too, if it helps more busy/lazy people to secure their GitHub repos I am glad!

See https://t.co/GyB0OTZyFP

[Jordi Boggiano @seldaek]

Composer 2.10 is out.

Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.

#php #phpc #composerphp

[The PHP Foundation @ThePHPF]

Today we published our Impact and Transparency Report for 2025. We are incredibly grateful for our sponsors, partners, contractors, and individual financial contributors for without them, none of our work would be possible. 💙 🐘https://t.co/2vzvicGbom
#php #opensource

[Packagist @packagist]

🔒An update on Composer & Packagist supply chain security: what's in place, what ships this week with Composer 2.10 (dependency policies, immutable versions), and what comes next.
If you maintain PHP packages, enable MFA now!
#php #phpc #composerphp

[nunomaduro @enunomaduro]

introducing laravel moat

as an open source maintainer, recent supply chain attacks in the ecosystem made me want a simple cli to audit the security of my GitHub organizations and repositories

built in Rust. for any open source project on GitHub

[Nils Adermann @naderman]

@enunomaduro @packagist @npmjs See https://t.co/FYBfKRjVRr

[Nils Adermann @naderman]

@enunomaduro @packagist @npmjs Automatic CI actions build releases and push them, or in PHP you do a git tag. This appears as a staged (hidden) release on the registry. The maintainer then needs to publish it with 2FA.

[Fabien Potencier @fabpot]

As an OSS maintainer, my new rule is that anything a frontier model can find with some reasonable effort is a 0-day. Hence why I'm now shipping security releases on public holidays.

[Nils Adermann @naderman]

@mitsuhiko They kept pushing new commits and tags even while we were already aware. Had to entirely remove the package on the registry to put an end to us redistributing the malware that is still present on GitHub now.

[Nils Adermann @naderman]

@mitsuhiko My impression is attacks on IDE plugins are enabling this. When attackers can just push commits & tags to legit repos, what safeguarded PHP Composer/Packagist and Go just falls apart. Wish I had had a way yesterday to get GitHub to block pushes to the repos