While executing composer require xxxx/module-xxxx I'm facing below error on the console. Repository is private at the moment.


Higher matching version 2.4.x of xxx/module-xxxx was found in public repository packagist.org  than 2.3.x in private https://repo.magento.com. 

Public package might've been taken over by a malicious entity,

please investigate and update package requirement to match the version from the private repository   

4 Answers 4


The error is caused by the 'magento/composer-dependency-version-audit-plugin' module. This module forces composer to prioritize private repositories over public repositories. And seems to also sometimes causes errors while unzipping modules.

The workaround is to just not install this plugin.

  • 1
    Even though this fixes the issue, this also explicitly circumvents a security feature introduced by Magento. Hence, I would not recommend taking this path.
    – Simon
    Commented Jan 14, 2022 at 8:19
  • 1
    Giving up on a genuine and/or valid package is not a workaround. Sometimes by the simple fact of delays on the marketplace on approving new releases affects all other users wanting to install some module or plugin. Commented Feb 16, 2022 at 4:46

When you have a module with a same name at packagist.org and at magento marketplace, and the first is newer than the second, this error will happen. This is caused by magento/composer-dependency-version-audit-plugin module, as explained in the official docs.

This may happen when you don't upload the newest version to the marketplace or they are taking too long to approve your submission.

I found at least 3 ways to workaround the issue, but another user here gave a 4th and better option (see solution #4):

Solution 1: install the latest version from Adobe's Marketplace

Just add --no-plugins to your composer require command.

For example: composer require ricardomartins/pagseguro --no-plugins.

This will ignore the above module execution and it will not check against packagist for newer versions. This way the above message will not be displayed.

Solution 2: Manually install the latest version

It's not really a solution, but if you really need the latest version from Packagist or Git, you may want to move the module to the app/code folder and remove it from composer dependencies (composer remove package/module).

Solution 3: Tell composer Magento is not a canonical repo

This way, if a newer version is available at packagist, it will be installed.

To do this, open composer.json file and add "canonical": false to Magento's repository, like follows:

  "repositories": [
            "type": "composer",
            "url": "https://repo.magento.com/",
            "canonical": false

Solution 4 🏆: To exclude offending package from the repository.

You can also exclude the package-vendor/module-name from the repo.magento.com repository

"repositories": {
    "0": {
        "type": "composer",
        "url": "https://repo.magento.com/",
        "exclude": ["package-vendor/module-name"]

Thus, running composer require package-vendor/module-name will always pick up the latest Packagist release.

(answer provided by @Julien Loizelet)

Further reading (in Portuguese): I wrote a help article about this for the users of my PagSeguro module for Magento facing the same issue.

  • 3. doesn't work in this case. Because the offending plugin will never accept a public repository. Commented Apr 6, 2022 at 15:29
  • Solution 1 worked very well for me! Thanks!
    – GuiTeK
    Commented May 25, 2022 at 9:52
  • 4
    As an alternative, you can also exclude the package-vendor/module-name from the repo.magento.com repository: "repositories": [ { "type": "composer", "url": "repo.magento.com", "exclude": ["package-vendor/module-name"] } ] Thus, running composer require package-vendor/module-name will always pick up the latest Packagist release. Commented Sep 9, 2022 at 4:18
  • Solution #1 doesn't always work, especially since composer often sees repo.magento.com as the higher priority repo, still preventing you from installing via Composer. Solution #3 is too heavy-handed. The comment here from @JulienLoizelet is really the best answer, as it allows you to selectively choose which modules may be excluded. Commented Oct 11, 2022 at 17:35
  • This should be the accepted answer. However, I also find it ridiculous that there is no way to remove a package from your Marketplace profile so that this can be avoided.
    – fritzmg
    Commented Nov 28, 2022 at 16:54

If the offending package comes from Packagist, this worked for me

"repositories": {
    "packagist.org": {
        "type": "composer",
        "url": "https://packagist.org",
        "exclude": ["package-vendor/module-name"]

I ran into this issue trying to install mageplaza/module-smtp on Ubuntu 20.04. I am not 100% sure why but it turned out composer was installed using apt-get. I removed it and re-installed and the module installed with no issue.

sudo apt-get remove composer

Then install composer

cd ~
curl -sS https://getcomposer.org/installer -o composer-setup.php
HASH=`curl -sS https://composer.github.io/installer.sig`
php -r "if (hash_file('SHA384', 'composer-setup.php') === '$HASH') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
alias composer='/usr/local/bin/composer'
  • 2
    thanks for the answer but it's not related to composer installation.
    – sandip
    Commented Jan 19, 2022 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.