I know this post is old, but I can add something important to this discussion that is not been mentioned. It happened to me today.

On Windows, when running a composer package install, the "vendor" folder location was relative to where I ran the command from. So:

C:\Users\User>composer require wolfcast/browser-detection

composer created the "vendor" folder in C:\Users\User\ - relative to the where I ran the command from.

Composer version 2.2.25