PECL is officially deprecated. Here is how PHP's new extension installer PIE works, why it exists, and how to use it to manage extensions like Composer.
Composer 2.10 adds native malware blocking and a unified config.policy framework for PHP supply chain security. Here is how it works and how to tune it.