Skip to content

Commit 4445f21

Browse files
AC-7983 update README.md
1 parent 6af6280 commit 4445f21

File tree

1 file changed

+22
-2
lines changed

1 file changed

+22
-2
lines changed

Diff for: README.md

+22-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,22 @@
1-
# composer-dependency-version-audit-plugin
2-
validating packages through a composer plugin
1+
# Composer dependency version audit plugin
2+
3+
This composer plugin is used to protect Adobe Commerce merchants from Dependency confusion attacks. It will detect when a public version of a package
4+
at packagist.org has a higher version than the one available from a private like repo.magento.com. When you try to install/update packages with composer,
5+
if it detects a potential issue, the plugin will give you a recommendation message and stop the process.
6+
7+
## Installation
8+
9+
```shell
10+
composer require magento/composer-dependency-version-audit-plugin
11+
```
12+
13+
## Usage
14+
15+
When you install/update composer, the composer plugin will stop the process if it detects a potential Dependency Confusion attack.
16+
In that case, composer install/update will fail with an error message similar to:
17+
18+
```composer log
19+
Higher matching version x.x.x of package/name was found in public repository packagist.org than x.x.x in private.repo.
20+
Public package might've been taken over by a malicious entity;
21+
please investigate and update package requirement to match the version from the private repository.
22+
```

0 commit comments

Comments
 (0)