Supply-Chain Attacks Could Be Possible Due to a PHP Composer Bug