Home / composer / composer
AI Slop Code RIsk Monitor

composer/composer

Dependency Manager for PHP

7.8 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for composer/composer, a PHP project with 29,548 GitHub stars. SynthScan examined 159,619 lines of code across 757 source files, recording 1243 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 7.8 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

7.8
Adjusted Signal
7.8
Raw Pattern Score
100%
Time Factor
2026-10-08
Last Push
29.5K
Stars
PHP
Language
159.6K
Lines of Code
757
Files
1.2K
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 32.1/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 1228 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 15 finding(s).

Agent Over-Engineering Ratio 32.0/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 1225 finding(s).

PR Review Velocity Impact 32.2/100 · MEDIUM

Which changes need focused human review? 1243 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 1243

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1243 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1225 hits · 1232 pts
SeverityFileLineSnippetContext
LOWtests/Composer/Test/CacheTest.php85 public function testRemoveFilesWhenCacheIsTooLarge(): voidCODE
LOWtests/Composer/Test/InstalledVersionsTest.php197 public function testGetVersionOutOfBounds(): voidCODE
LOWtests/Composer/Test/InstalledVersionsTest.php250 public function testGetInstalledPackagesByType(): voidCODE
LOWtests/Composer/Test/InstalledVersionsTest.php270 public function testWithClassLoaderLoaded(): voidCODE
LOW⚡tests/Composer/Test/ComposerTest.php37 public function testSetGetRepositoryManager(): voidCODE
LOW⚡tests/Composer/Test/ComposerTest.php46 public function testSetGetDownloadManager(): voidCODE
LOW⚡tests/Composer/Test/ComposerTest.php56 public function testSetGetInstallationManager(): voidCODE
LOWtests/Composer/Test/InstallerTest.php250 public function testIntegrationWithPoolOptimizer(string $file, string $message, ?string $condition, array $composerCCODE
LOWtests/Composer/Test/InstallerTest.php266 public function testIntegrationWithRawPool(string $file, string $message, ?string $condition, array $composerConfig,CODE
LOWtests/Composer/Test/InstallerTest.php491 public static function provideSlowIntegrationTests(): arrayCODE
LOWtests/Composer/Test/FactoryTest.php29 public function testDefaultValuesAreAsExpected(): voidCODE
LOWtests/Composer/Test/FactoryTest.php53 public function testGetComposerJsonPathFailsIfDir(): voidCODE
LOWtests/Composer/Test/FactoryTest.php61 public function testGetComposerJsonPathFromEnv(): voidCODE
LOWtests/Composer/Test/TestCase.php348 protected static function ensureDirectoryExistsAndClear(string $directory): voidCODE
LOWtests/Composer/Test/DefaultConfigTest.php22 public function testDefaultValuesAreAsExpected(): voidCODE
LOW⚡tests/Composer/Test/ConfigTest.php646 public function testOverridesGlobalBooleanPluginsConfig(): voidCODE
LOW⚡tests/Composer/Test/ConfigTest.php656 public function testAllowsAllPluginsFromLocalBoolean(): voidCODE
LOW⚡tests/Composer/Test/ConfigTest.php666 public function testStrictPsrAutoloaderDefaultsToFalse(): voidCODE
LOW⚡tests/Composer/Test/ConfigTest.php672 public function testStrictPsrAutoloaderCanBeDisabled(): voidCODE
LOW⚡tests/Composer/Test/ConfigTest.php679 public function testStrictPsrAutoloaderCanBeSetFromString(): voidCODE
LOWtests/Composer/Test/ConfigTest.php28 public function testAddPackagistRepository(array $expected, array $localConfig, ?array $systemConfig = null): voidCODE
LOWtests/Composer/Test/ConfigTest.php39 public static function dataAddPackagistRepository(): arrayCODE
LOWtests/Composer/Test/ConfigTest.php146 public function testPreferredInstallAsString(): voidCODE
LOWtests/Composer/Test/ConfigTest.php155 public function testMergePreferredInstall(): voidCODE
LOWtests/Composer/Test/ConfigTest.php213 public function testFetchingRelativePaths(): voidCODE
LOWtests/Composer/Test/ConfigTest.php227 public function testOverrideGithubProtocols(): voidCODE
LOWtests/Composer/Test/ConfigTest.php236 public function testGitDisabledByDefaultInGithubProtocols(): voidCODE
LOWtests/Composer/Test/ConfigTest.php259 public function testProhibitedUrlsThrowException(string $url): voidCODE
LOWtests/Composer/Test/ConfigTest.php310 public function testProhibitedUrlsWarningVerifyPeer(): voidCODE
LOWtests/Composer/Test/ConfigTest.php328 public function testDisableTlsCanBeOverridden(): voidCODE
LOWtests/Composer/Test/ConfigTest.php377 public function testGetSourceOfValueEnvVariables(): voidCODE
LOWtests/Composer/Test/ConfigTest.php484 public function testPolicyListBoolTrueAndEmptyObjectAreEquivalentInLayering(): voidCODE
LOWtests/Composer/Test/ConfigTest.php497 public function testPolicyListFalseOverridesPriorTrueOrEmptyEquallyAcrossLayers(): voidCODE
LOWtests/Composer/Test/ConfigTest.php514 public function testPolicyMasterTrueAfterDetailedConfigDoesNotEraseDetail(): voidCODE
LOWtests/Composer/Test/ConfigTest.php530 public function testPolicyDeepMergesIgnoreAcrossSources(): voidCODE
LOWtests/Composer/Test/ConfigTest.php568 public function testPolicyDeepMergesIgnoreForMalwareAndAbandonedAndCustomList(): voidCODE
LOWtests/Composer/Test/ConfigTest.php617 public function testGetDefaultsToAnEmptyArray(): voidCODE
LOW…/Composer/Test/Repository/FilesystemRepositoryTest.php48 public function testCorruptedRepositoryFile(): voidCODE
LOW…/Composer/Test/Repository/FilesystemRepositoryTest.php67 public function testUnexistentRepositoryFile(): voidCODE
LOW…/Composer/Test/Repository/FilesystemRepositoryTest.php127 public function testRepositoryWritesInstalledPhp(): voidCODE
LOW…/Composer/Test/Repository/FilesystemRepositoryTest.php201 public function testSafelyLoadInstalledVersions(): voidCODE
LOW…sts/Composer/Test/Repository/RepositoryManagerTest.php88 public static function provideRepoCreationTestCases(): arrayCODE
LOW…sts/Composer/Test/Repository/RepositoryManagerTest.php111 public function testInvalidRepoCreationThrows(string $type, array $options): voidCODE
LOW…sts/Composer/Test/Repository/RepositoryManagerTest.php128 public static function provideInvalidRepoCreationTestCases(): arrayCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php220 public function testSearchWithSpecialChars(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php247 public function testSearchWithAbandonedPackages(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php323 public static function provideCanonicalizeUrlTestCases(): arrayCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php361 public function testGetProviderNamesWillReturnPartialPackageNames(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php390 public function testGetSecurityAdvisoriesAssertRepositoryHttpOptionsAreUsed(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php439 public function testGetSecurityAdvisoriesAssertRepositoryAdvisoriesIsZeroIndexedArrayWithConsecutiveKeys(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php518 public function testGetSecurityAdvisoriesBatchesLargeRequests(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php576 public function testGetFilterWithMatchingLists(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php624 public function testUserFilterDisabledFalseShortCircuitsHasFilterAndGetFilterLists(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php642 public function testUserFilterPerListOptOut(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php685 public function testUserFilterAcceptsTrueAsNoOp(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php729 public function testGetFilterSkipsMetadataFetchesForPackagesNotInSummary(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php793 public function testGetFilterSkipsSummaryListsNotInConfiguredLists(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php842 public function testGetFilterSkipsPackagesWithNonIntersectingSummaryConstraint(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php888 public function testGetFilterSkipsSummaryWhenMetadataAlreadyFetched(): voidCODE
LOW…ts/Composer/Test/Repository/ComposerRepositoryTest.php1014 public function testGetFilterUsesApiUrlInsteadOfSummary(): voidCODE
1165 more matches not shown…
Fake / Example Data15 hits · 16 pts
SeverityFileLineSnippetContext
LOWtests/Composer/Test/ConfigTest.php297 'http://💛@example.org',CODE
LOWtests/Composer/Test/Repository/VcsRepositoryTest.php73 $exec('git config user.email composertest@example.org');CODE
LOWtests/Composer/Test/Util/SvnTest.php44 ['svn://johndoe@example.org', ['--username', 'johndoe', '--password', '']],CODE
LOWtests/Composer/Test/Util/ProcessExecutorTest.php83 ['echo http://foo@example.org', 'echo http://foo@example.org'],CODE
LOWtests/Composer/Test/Util/UrlTest.php141 ['http://10a***:***@example.org', 'http://10a8f08e8d7b7b9:foo@example.org'],CODE
LOW⚡tests/Composer/Test/Util/UrlTest.php152 ['http://10a***@example.org', 'http://10a8f08e8d7b7b9@example.org'],CODE
LOW⚡tests/Composer/Test/Util/UrlTest.php161 ['10a***:***@example.org', '10a8f08e8d7b7b9:foo@example.org'],CODE
LOW⚡tests/Composer/Test/Util/UrlTest.php168 ['10a***@example.org', '10a8f08e8d7b7b9@example.org'],CODE
LOWtests/Composer/Test/Command/InitCommandTest.php175 'email' => 'test@example.org',CODE
LOWtests/Composer/Test/Command/InitCommandTest.php463 'authors' => [['name' => 'Mr. Test', 'email' => 'test@example.org']],CODE
LOW…oser/Test/Package/Loader/ValidatingArrayLoaderTest.php61 'email' => 'alice@example.org',CODE
LOW…oser/Test/Package/Loader/ValidatingArrayLoaderTest.php71 'email' => 'mail@example.org',CODE
LOWtests/Composer/Test/Package/Loader/ArrayLoaderTest.php193 ['name' => 'Bob', 'email' => 'bob@example.org', 'homepage' => 'example.org', 'role' => 'Developer'],CODE
LOWdoc/04-schema.md268 "email": "support@example.org",CODE
LOWdoc/articles/authentication-for-private-packages.md183 "url": "https://username:password@example.org"CODE
Over-Commented Block3 hits · 3 pts
SeverityFileLineSnippetContext
LOW…ts/Composer/Test/Repository/ArtifactRepositoryTest.php81 foreach ($repo->getPackages() as $package) {COMMENT
LOW…ts/Composer/Test/Repository/ArtifactRepositoryTest.php101// "subdir/extra2.txt" => "Testing testing testing",COMMENT
LOW…ts/Composer/Test/Repository/ArtifactRepositoryTest.php121//COMMENT