cyclonedx/cyclonedx-php-composer (installed globally) contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe. You can run "composer global config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer [true|false]" to enable it (true) or disable it explicitly and suppress this exception (false) See https://getcomposer.org/allow-plugins