3 ms·

Does anyone know if composer ever uses PEAR?

• rawfan 8y ago
  It doesn't.
  • Gigablah 8y ago
    Composer does support pulling packages from PEAR (https://getcomposer.org/doc/05-repositories.md#pear https://getcomposer.org/doc/05-repositories.md#pear), but through their own implementation and not go-pear.phar.
  • SmellyGeekBoy 8y ago
    ...but that doesn't mean that it wouldn't also be susceptible to this kind of attack.