Installatron removes my manually added module from composer

Not sure how to ask this, but please bear with me. I am on godaddy shared hosting, which is why I cannot do a composer update
because of limited memory. So the workaround to that is I have cloned the site in my localhost and running composer update in my local server then copying the composer.lock file to my server then run the composer update. This allows me to update a module install in limited memory. But the problem is this: I have got auto-update on my cPanel for that site. I just realized that upon cPanel updated my site, it then removed that particular module from the site. I do have that particular module in the composer.json, but that didn't help. Where does the cPanel Installatron update the site from, which composer.json or composer.lock to rely on?