See https://github.com/phacility/xhprof/pull/40. This is currently broken and extremely insecure.
We may want to restore it eventually, but understanding composer is very complex (no one who touched this realized that the package was owned by someone unrelated to the project who can apparently redirect it at will with no accountability). No one on the ticket seems to have any reason why this isn't totally wide open, and I haven't gotten in touch with anyone in #composer-dev.