sansec / composer-integrity-plugin
Installs: 12 213
Dependents: 1
Suggesters: 0
Security: 0
Stars: 41
Watchers: 2
Forks: 4
Open Issues: 2
Type:composer-plugin
Requires
- php: >=8.1
- composer-plugin-api: ^2.0
- guzzlehttp/guzzle: >=6.0
- php-di/php-di: ^7.0
Requires (Dev)
- composer/composer: ^2.0
README
Check your installed composer packages against a list of known correct checksums (provided by Sansec).
This plugin calculates a one-way hash of:
- composer.json and composer.lock
- package name and package versions
- file contents of the installed packages (checksum)
These hashes are then tested against a larger database hosted at Sansec. The use of one-way hashing provides a secure way to test your setup, without sharing file contents with a third party. The Sansec API does not store your hashes.
Installation & Usage
Composer Plugin
composer require sansec/composer-integrity-plugin
You can then run it:
composer integrity
PHAR
Head over to the releases page and download the latest PHAR.
You can then run it:
php composer-integrity.phar
Configuration
Both the plugin as well as the PHAR take the following optional options:
--skip-match
: shows only non-matching checksums--json
: output is in json format instead of a table
Why did we make this?
Sansec specializes in forensic investigations of breached Magento stores. We noticed an increase of cases where malware was hidden in legitimate libraries under vendor
. Most package managers provide some sort of integrity check for installed software, but composer does not. So, we made this plugin in order to quickly verify the integrity of an installation.
Alternatively, you could clone the composer files, recreate vendor and run a diff against your installation. But this takes much more time and original dependencies are not always available on production servers.
Caveats
The plugin does not consider patches, such as those applied through composer-patches, via a post-install-cmd
composer script, or editing in vendor
outright.
In such instances, it is the user's responsibility to assess the situation and take appropriate action.
License
MIT License - Copyright (c) 2023 Sansec