diff --git a/src/Package_Command.php b/src/Package_Command.php
index b95a3d29..453bf2bd 100644
--- a/src/Package_Command.php
+++ b/src/Package_Command.php
@@ -1283,7 +1283,7 @@ private function create_default_composer_json( $composer_path ) {
 
 		$composer_dir = pathinfo( $composer_path, PATHINFO_DIRNAME );
 		if ( ! is_dir( $composer_dir ) ) {
-			if ( ! @mkdir( $composer_dir, 0777, true ) ) { // @codingStandardsIgnoreLine
+			if ( ! @mkdir( $composer_dir, 0700, true ) ) { // @codingStandardsIgnoreLine
 				$error = error_get_last();
 				WP_CLI::error( sprintf( "Composer directory '%s' for packages couldn't be created: %s", $composer_dir, $error['message'] ) );
 			}
diff --git a/tests/phpunit/ComposerJsonTest.php b/tests/phpunit/ComposerJsonTest.php
index 21af48fb..2f48e91e 100644
--- a/tests/phpunit/ComposerJsonTest.php
+++ b/tests/phpunit/ComposerJsonTest.php
@@ -87,6 +87,9 @@ public function test_create_default_composer_json() {
 		$actual   = $create_default_composer_json->invoke( $package, $expected );
 		$this->assertSame( $this->mac_safe_path( realpath( $expected ) ?: $expected ), $this->mac_safe_path( realpath( $actual ) ?: $actual ) );
 		$this->assertTrue( false !== strpos( file_get_contents( $actual ), 'wp-cli/wp-cli' ) );
+		if ( ! Utils\is_windows() ) {
+			$this->assertSame( '0700', substr( sprintf( '%o', fileperms( dirname( $actual ) ) ), -4 ) );
+		}
 		unlink( $actual );
 		rmdir( dirname( $actual ) );
 	}