Composer tag rewriting is the act of force pushing an existing release tag to a different commit after it has already been published. In supply chain attacks, this breaks the trust that version numbers imply fixed source code and can redirect installs to malicious content without changing the visible version string.
Expanded Definition
Composer tag rewriting is a package supply chain integrity failure in which a release tag that once pointed to one commit is later moved to another commit, while the version label stays the same. In ecosystems that depend on semantic versioning, this undermines the assumption that a published tag identifies immutable source code. The result is not simply a versioning issue but a trust break: consumers, build systems, and dependency scanners may continue to treat the tagged release as unchanged even though the underlying code has been replaced. This is closely related to repository tampering and differs from normal release management, where tags are created once and never repointed. For governance language, the better framing is that tag immutability is an integrity control, even though no single standard governs Composer tag rewriting itself. NIST guidance on software and supply chain risk, including the NIST Cybersecurity Framework 2.0, supports the broader control objective of protecting software provenance and change integrity.
The most common misapplication is treating a changed tag as a routine release update, which occurs when teams trust the version string but do not verify the commit history behind it.
Examples and Use Cases
Implementing release integrity rigorously often introduces operational friction, requiring organisations to balance fast publishing workflows against the cost of stronger provenance checks.
- A maintainer republishes
v1.4.2so the tag now resolves to a different commit, and downstream builds silently pull altered code. - A dependency pinning policy records only the Composer version string, but not the commit hash, allowing a rewritten tag to bypass change detection.
- A security team compares package metadata against a trusted source and finds the tag moved after publication, prompting a provenance investigation.
- Automated build pipelines fetch tags directly from public repositories instead of verifying immutable references, creating room for poisoned releases.
- After an incident, a team adopts commit-signing, protected tags, and release attestation practices aligned with software integrity guidance from NIST Cybersecurity Framework 2.0 and related supply chain controls.
Why It Matters for Security Teams
Security teams care about Composer tag rewriting because it converts version trust into an attack surface. If build systems, package mirrors, or developer tooling assume that a tag is permanent, an attacker who can alter the tag can redirect installations without changing the visible release name. That creates a weak point in software provenance, incident response, and third-party risk management. The impact is broader than PHP ecosystems: any organisation consuming source packages needs to understand that tag integrity is part of supply chain security, not just repository hygiene. Controls such as protected tags, signed commits, release attestations, and dependency verification reduce exposure, while continuous monitoring can alert teams when tags drift after publication. The NIST Cybersecurity Framework 2.0 provides a useful governance lens for identifying, protecting, and detecting integrity failures across software delivery paths. Organisations typically encounter this risk only after a build or deployment has already pulled altered code, at which point Composer tag rewriting becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the technical controls, and EU Cyber Resilience Act define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS | Data integrity and software provenance controls are directly implicated by rewritten release tags. |
| NIST SP 800-53 Rev 5 | CM-5 | Configuration change control supports preventing unauthorized tag movement in release repositories. |
| OWASP Non-Human Identity Top 10 | Package identities and release provenance are relevant to non-human identity and supply chain trust. | |
| NIST AI RMF | Governance and map functions support provenance, accountability, and lifecycle risk for software artifacts. | |
| EU Cyber Resilience Act | The regulation emphasizes software supply chain security and integrity across product lifecycle. |
Treat package release artifacts as identities that must be authenticated and monitored for tampering.
Related resources from NHI Mgmt Group
- What is the difference between identity orchestration and application rewriting?
- What should organisations do when an agent starts mutating state or rewriting memory?
- What breaks when SAP NetWeaver Visual Composer is exposed to unauthenticated upload abuse?
- How should teams reduce IAM technical debt without rewriting every application?
