Dynamic analysis support and PHP should work well together. Additionally github.com/ossf/package-feeds supports Packagist already, so adding PHP + Packagist support to Package Analysis is possible and should produce results.

This largely amounts to:

1. setting up a new sandbox.
2. writing an analysis script that installs, and can import the PHP library (ideally it can import each source file).
3. adding the necessary API calls to retrieve package data from Packagist.
4. updating the scheduler to pass through Packagist packages from the feed.