On Drupal 9 one has to install with composer/composer:2.0.13

[hkirsman]

This was the full install command for me

 composer require wunderio/code-quality:2.0.3 symplify/easy-coding-standard:8.3.48 wunderio/ecs-drupal:1.0.0 composer/xdebug-handler:1.4.6 composer/composer:2.0.13  --dev

on https://packagist.org/packages/composer/composer#2.1.8 you can see that anything below 2.1.8 has security issues.

I think the offending package is this https://github.com/wunderio/ecs-drupal/blob/master/composer.json where it asks for quite old package ECS 8.3 https://packagist.org/packages/symplify/easy-coding-standard#8.3.48