3 ms·

It doesn't.

• Gigablah 8y ago
  Composer does support pulling packages from PEAR (https://getcomposer.org/doc/05-repositories.md#pear https://getcomposer.org/doc/05-repositories.md#pear), but through their own implementation and not go-pear.phar.
• SmellyGeekBoy 8y ago
  ...but that doesn't mean that it wouldn't also be susceptible to this kind of attack.