@SocketSecurity@fosstodon.org thanks for reporting this. Composer plugins are only executed after giving permission by the user (unless the package already has been allowed for plugins, which seems not the case here according to your write-up). Is it correct that if the user did not allow composer to run the plugin, the malicious code has not been executed?