When installing a new system from a lock file (empty vendor directory, lock file in place) with composer install under some circumstances results in the module not properly installing to the /vendor/simplesamlphp/simplesamlphp/modules location, instead will end up in /modules. This seems to be the result of composer installing the module package before the base simpleSAMLphp package has been installed.
This is fixed by adding the simpleSAMLphp base module as a dependency in the module composer.json to ensure composer installs it first, see #3 .