> There's no colors/faker/left-pad drama.
Yet. Composer packages have the same attack surface as NPM packages, the only thing that is different is that there are (outside of frameworks like Drupal and Symfony) no automated post-install scripts that get executed during a "composer install".
The fundamental difference is that lots of what is popular in the NPM world isn't needed in the Composer world at all due to PHP's extensive stdlib (meaning, less people having to maintain trivialities like left-pad and thus less potential for people to get hacked/sell out/get burned out in frustration).
Furthermore, most highly popular PHP projects have extensive corporate, consulting or foundational backing - Symfony, Drupal, PHPUnit, Laravel, Typo3, MediaWiki, Wordpress to name the biggest players - and each of these provides to developers what the stdlib is missing, so there are strict QA and release procedures to prevent a repeat of the current colors/faker events.