--- title: Your composer.lock knows what a carmaker only guesses description: A Chinese automaker (SAIC) accidentally listed an Android botnet (Teardroid) in its open source attribution for the MG4, revealing that the SBOM was generated... canonical: https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your composer.lock knows what a carmaker only guesses | daily.dev og:description: A Chinese automaker (SAIC) accidentally listed an Android botnet (Teardroid) in its open source attribution for the MG4, revealing that the SBOM was generated... og:url: https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4 og:image: https://api.daily.dev/og/posts/hkHirUAY4.png og:image:alt: Your composer.lock knows what a carmaker only guesses og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your composer.lock knows what a carmaker only guesses **[PHPUnit Expert](https://daily.dev/sources/phpunit-expert)** · 8 min read · 0 upvotes · 0 comments ## Summary A Chinese automaker (SAIC) accidentally listed an Android botnet (Teardroid) in its open source attribution for the MG4, revealing that the SBOM was generated by scanning binaries rather than declared dependencies. This exposes a fundamental flaw: scanning produces guesses, while declared dependency management produces facts. In the PHP ecosystem, composer.lock already provides an accurate, hash-verified dependency list that can be exported as a standards-compliant CycloneDX SBOM via the cyclonedx-php-composer plugin. PHPUnit's PHAR distribution demonstrates best practice by embedding its own SBOM, manifest, and composer.lock directly in the artifact, complemented by PGP signatures. The key lesson: dependencies should be declared and managed through a single mechanism (Composer), not vendored manually or reconstructed after the fact. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [What ISO/IEC 18974 asks of your composer.lock](https://daily.dev/posts/what-iso-iec-18974-asks-of-your-composer-lock-xup192zpo) · PHPUnit Expert · 0 upvotes · 0 comments - [Introducing PHP and Composer Support in Socket](https://daily.dev/posts/introducing-php-and-composer-support-in-socket-u5uczrhng) · Socket · 41 upvotes · 0 comments - [Software Bill of Materials in Percona Server for MongoDB](https://daily.dev/posts/software-bill-of-materials-in-percona-server-for-mongodb-lixekv4lk) · Percona Blog · 0 upvotes · 0 comments - [How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise](https://daily.dev/posts/how-sboms-and-engineering-discipline-can-help-you-avoid-trivy-s-compromise-c6zqbaibq) · InfoQ · 0 upvotes · 0 comments - [SBOM Generation for Container Workflows](https://daily.dev/posts/sbom-generation-for-container-workflows-nctydjhq9) · Docker · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sbom](https://daily.dev/tags/sbom), [#phpunit](https://daily.dev/tags/phpunit) [View this post on daily.dev](https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your composer.lock knows what a carmaker only guesses","url":"https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4"},"datePublished":"2026-08-05T04:08:51.778Z","dateModified":"2026-08-05T04:09:15.091Z","description":"A Chinese automaker (SAIC) accidentally listed an Android botnet (Teardroid) in its open source attribution for the MG4, revealing that the SBOM was generated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79241901bca477437ec7d90529c3a3a4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79241901bca477437ec7d90529c3a3a4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"PHPUnit Expert","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PHPUnit Expert","logo":"https://media.daily.dev/image/upload/s--FMZoysoG--/f_auto,q_auto/v1774964057/logos/phpunit-expert?_a=BAMAMiWQ0","url":"https://daily.dev/sources/phpunit-expert"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-composer-lock-knows-what-a-carmaker-only-guesses-hkhiruay4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sbom,phpunit","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHPUnit Expert","item":"https://daily.dev/sources/phpunit-expert"},{"@type":"ListItem","position":3,"name":"Your composer.lock knows what a carmaker only guesses"}]} ```