I have found this to be the most reliable method. It is possible that not all packages downloaded by composer will end up in the vendor directory. Particularly for CakePHP, many packages are actually plugins and will get moved to the Plugins directory.