I really enjoy using Composer as well but my exposure is limited. Does composer do anything for security that npm fails at? The most I've seen is that packages in composer tend to have way less dependencies than npm packages but that's not really a great reason to call it more secure (better, yes, but not ideal). Just wondering if Composer has some security features that I'm not aware of.