Automic Vault

brew package intelligence

composer

Automic Vault tracks composer because plain text composer auth matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about composer

Dependency Manager for PHP

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text Composer Auth

Composer stores repository passwords and service tokens in auth.json. Our isotope stores that auth file in the macOS keychain and injects it as COMPOSER_AUTH only while `composer` runs.

Local README excerpt

Composer Radioisotope

Composer stores repository credentials and service tokens in auth.json. Those entries can include HTTP basic passwords, GitHub OAuth tokens, GitLab tokens, and bearer tokens.

This radioisotope migrates the first default Composer auth.json containing credentials into the macOS keychain and wraps composer so it receives those credentials through COMPOSER_AUTH only while it runs.

Caveats

  • We currently migrate the first default auth.json containing credentials.
  • Project-local auth.json files are not migrated.
  • Direct execution of the original binary will not receive credentials.

Source: data/radioisotopes/composer/README.md

Caveats

  • We currently migrate the first default auth.json containing credentials.
  • Project-local auth.json files are not migrated.
  • Direct execution of the original binary will not receive credentials.

install metadata

Resolver facts

Package keybrew:composer
Last updated2026-05-13T09:56:15Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • local isotope README
  • radioisotope security manifest