What make it worse: there are multiple implementation of composer, with small different in behaviour.

The extra security meant many automation tasks need to be done as extensions on composer level making this even worse