No. According to the Composer documentation, only scripts defined in the root package's composer.json are executed. Scripts a dependency declares in its own composer.json do not run when you install it. Vendor code can still run through plugins and through autoloaded files, so those need review too.
Why people worry about this
Developers coming from other ecosystems know install time hooks that run arbitrary commands from any dependency. It is natural to ask whether PHP has the same exposure. For Composer scripts, the answer is better than many expect. Your own scripts, such as post-install-cmd or post-autoload-dump, run because you wrote them. A package you pull in cannot add its own.
What can still run vendor code
| Mechanism | Runs when | Who controls it |
|---|---|---|
| Root scripts in composer.json | Install, update, autoload dump | You |
| Dependency scripts | Never run by Composer | Not applicable |
| Plugins | As soon as installed and on later runs | Gated by allow-plugins |
| Autoload files entries | On every request in your app | Package author |
| Normal class loading | When your code uses the class | Package author |
The last two rows are the quiet ones. The docs say the files autoload mechanism requires listed files explicitly on every request. That is intended for helper functions. It also means a compromised release can execute code the first time your application boots, with no install step involved.
Steps to reduce exposure
- Keep the allow-plugins list short, and review additions.
- Read your own root scripts. A script that pipes a downloaded file into a shell is a risk of your own making.
- After an update, scan the composer.lock diff for packages you did not expect.
- For new packages, open composer.json and check the autoload section for files entries.
- Run installs in CI with no secrets in the environment where possible.
composer install --no-scripts --no-plugins
The no-scripts and no-plugins options are global Composer options. The first skips root scripts, the second disables installed plugins. They are handy when you are inspecting an unfamiliar project and do not want it to run anything yet.
A caution on pre-install scripts
The scripts page warns that Composer makes no assumptions about the state of your dependencies before an install or update. Do not rely on vendor packages inside pre-install-cmd or pre-update-cmd.
Try it yourself
Click through it at your own pace, or open it full screen. Compare a package that is merely present with one whose code path your application actually runs.
Where Safeguard fits
Safeguard's reachability analysis helps separate advisories your code can reach from those it cannot. You can try a free scan on your own lock file.
Quick check
Can a dependency run code when I run composer install?
Through scripts, no. Through an allowed plugin, yes. After install, any code your app loads can run, including autoload files entries.
Does no-scripts also stop plugins?
No. Plugins have their own option, no-plugins, and their own allow list.
Sources
Last reviewed: 19 October 2026.
