Why wordpress.org Won't Let You Install Composer Packages From a Plugin
We built a Composer UI for the WordPress admin, then asked wordpress.org's review team if it belonged in the official directory. Guideline 8 says no, dynamically installed executable code is never acceptable there, no matter how it's used. Here's the rule, and the one-codebase, two-edition architecture we shipped instead.