diff --git a/src/Package_Command.php b/src/Package_Command.php
index 453bf2bd..81621306 100644
--- a/src/Package_Command.php
+++ b/src/Package_Command.php
@@ -1283,7 +1283,7 @@ private function create_default_composer_json( $composer_path ) {
 
 		$composer_dir = pathinfo( $composer_path, PATHINFO_DIRNAME );
 		if ( ! is_dir( $composer_dir ) ) {
-			if ( ! @mkdir( $composer_dir, 0700, true ) ) { // @codingStandardsIgnoreLine
+			if ( ! @mkdir( $composer_dir, 0755, true ) ) { // @codingStandardsIgnoreLine
 				$error = error_get_last();
 				WP_CLI::error( sprintf( "Composer directory '%s' for packages couldn't be created: %s", $composer_dir, $error['message'] ) );
 			}
diff --git a/tests/phpunit/ComposerJsonTest.php b/tests/phpunit/ComposerJsonTest.php
index 2f48e91e..17e78a1f 100644
--- a/tests/phpunit/ComposerJsonTest.php
+++ b/tests/phpunit/ComposerJsonTest.php
@@ -88,7 +88,15 @@ public function test_create_default_composer_json() {
 		$this->assertSame( $this->mac_safe_path( realpath( $expected ) ?: $expected ), $this->mac_safe_path( realpath( $actual ) ?: $actual ) );
 		$this->assertTrue( false !== strpos( file_get_contents( $actual ), 'wp-cli/wp-cli' ) );
 		if ( ! Utils\is_windows() ) {
-			$this->assertSame( '0700', substr( sprintf( '%o', fileperms( dirname( $actual ) ) ), -4 ) );
+			// The invariant that matters is that no other local user can write into the packages
+			// directory, whose `vendor/autoload.php` is required on every WP-CLI run. The exact
+			// mode depends on the umask, so assert the write bits rather than the literal mode.
+			$perms = fileperms( dirname( $actual ) ) & 0777;
+			$this->assertSame(
+				0,
+				$perms & 0022,
+				sprintf( 'Packages directory must not be group- or world-writable, got %o.', $perms )
+			);
 		}
 		unlink( $actual );
 		rmdir( dirname( $actual ) );