
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@oclif/plugin-plugins
Advanced tools
plugins plugin for oclif
This plugin is used to allow users to install plugins into your oclif CLI at runtime. For example, in the Heroku CLI this is used to allow people to install plugins such as the Heroku Kafka plugin:
$ heroku plugins:install heroku-kafka
$ heroku kafka
This is useful to allow users to create their own plugins to work in your CLI or to allow you to build functionality that users can optionally install.
One particular way this is useful is for building functionality you aren't ready to include in a public repository. Build your plugin separately as a plugin, then include it as a core plugin later into your CLI.
First add the plugin to your project with yarn add @oclif/plugin-plugins, then add it to the package.json of the oclif CLI:
{
"name": "mycli",
"version": "0.0.0",
// ...
"oclif": {
"plugins": ["@oclif/plugin-help", "@oclif/plugin-plugins"]
}
}
Now the user can run any of the commands below to manage plugins at runtime.
To make it simpler for users to install plugins, we have "friendly name" functionality. With this, you can run mycli plugins:install myplugin and it will first check if @mynpmorg/plugin-myplugin exists on npm before trying to install myplugin. This is useful if you want to use a generic name that's already taken in npm.
To set this up, simply set the oclif.scope to the name of your npm org. In the example above, this would be mynpmorg.
Over time in the Heroku CLI we've changed plugin names, brought plugins into the core of the CLI, or sunset old plugins that no longer function. There is support in this plugin for dealing with these situations.
For renaming plugins, add an alias section to oclif.aliases in package.json:
"aliases": {
"old-name-plugin": "new-name-plugin"
}
If a user had old-name-plugin installed, the next time the CLI is updated it will remove old-name-plugin and install new-name-plugin. If a user types mycli plugins:install old-name-plugin it will actually install new-name-plugin instead.
For removing plugins that are no longer needed (either because they're sunset or because they've been moved into core), set the alias to null:
"aliases": {
"old-name-plugin": null
}
old-name-plugin will be autoremoved on the next update and will not be able to be installed with mycli plugins:install old-name-plugin.
<CLI>_USE_NETWORK_MUTEX if true, use the --mutex=network option on yarn operations
<CLI>_NETWORK_MUTEX_PORT specify the port for the mutex=network option, depends on <CLI>_USE_NETWORK_MUTEX
<CLI>_NETWORK_TIMEOUT specify the --network-timeout option on yarn operation (set in milliseconds)
mycli pluginsmycli plugins:install PLUGIN...mycli plugins:inspect PLUGIN...mycli plugins:install PLUGIN...mycli plugins:link PLUGINmycli plugins:uninstall PLUGIN...mycli plugins resetmycli plugins:uninstall PLUGIN...mycli plugins:uninstall PLUGIN...mycli plugins updatemycli pluginsList installed plugins.
USAGE
$ mycli plugins [--json] [--core]
FLAGS
--core Show core plugins.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
List installed plugins.
EXAMPLES
$ mycli plugins
See code: src/commands/plugins/index.ts
mycli plugins:install PLUGIN...Installs a plugin into the CLI.
USAGE
$ mycli plugins add plugins:install PLUGIN...
ARGUMENTS
PLUGIN Plugin to install.
FLAGS
-f, --force Run yarn install with force flag.
-h, --help Show CLI help.
-s, --silent Silences yarn output.
-v, --verbose Show verbose yarn output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into the CLI.
Can be installed from npm or a git url.
Installation of a user-installed plugin will override a core plugin.
e.g. If you have a core plugin that has a 'hello' command, installing a user-installed plugin with a 'hello' command
will override the core plugin implementation. This is useful if a user needs to update core plugin functionality in
the CLI without the need to patch and update the whole CLI.
ALIASES
$ mycli plugins add
EXAMPLES
$ mycli plugins add myplugin
$ mycli plugins add https://github.com/someuser/someplugin
$ mycli plugins add someuser/someplugin
mycli plugins:inspect PLUGIN...Displays installation properties of a plugin.
USAGE
$ mycli plugins inspect PLUGIN...
ARGUMENTS
PLUGIN [default: .] Plugin to inspect.
FLAGS
-h, --help Show CLI help.
-v, --verbose
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Displays installation properties of a plugin.
EXAMPLES
$ mycli plugins inspect myplugin
See code: src/commands/plugins/inspect.ts
mycli plugins:install PLUGIN...Installs a plugin into the CLI.
USAGE
$ mycli plugins install PLUGIN...
ARGUMENTS
PLUGIN Plugin to install.
FLAGS
-f, --force Run yarn install with force flag.
-h, --help Show CLI help.
-s, --silent Silences yarn output.
-v, --verbose Show verbose yarn output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into the CLI.
Can be installed from npm or a git url.
Installation of a user-installed plugin will override a core plugin.
e.g. If you have a core plugin that has a 'hello' command, installing a user-installed plugin with a 'hello' command
will override the core plugin implementation. This is useful if a user needs to update core plugin functionality in
the CLI without the need to patch and update the whole CLI.
ALIASES
$ mycli plugins add
EXAMPLES
$ mycli plugins install myplugin
$ mycli plugins install https://github.com/someuser/someplugin
$ mycli plugins install someuser/someplugin
See code: src/commands/plugins/install.ts
mycli plugins:link PLUGINLinks a plugin into the CLI for development.
USAGE
$ mycli plugins link PLUGIN
ARGUMENTS
PATH [default: .] path to plugin
FLAGS
-h, --help Show CLI help.
-v, --verbose
--[no-]install Install dependencies after linking the plugin.
DESCRIPTION
Links a plugin into the CLI for development.
Installation of a linked plugin will override a user-installed or core plugin.
e.g. If you have a user-installed or core plugin that has a 'hello' command, installing a linked plugin with a 'hello'
command will override the user-installed or core plugin implementation. This is useful for development work.
EXAMPLES
$ mycli plugins link myplugin
See code: src/commands/plugins/link.ts
mycli plugins:uninstall PLUGIN...Removes a plugin from the CLI.
USAGE
$ mycli plugins remove plugins:uninstall PLUGIN...
ARGUMENTS
PLUGIN plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins remove myplugin
mycli plugins resetRemove all user-installed and linked plugins.
USAGE
$ mycli plugins reset
See code: src/commands/plugins/reset.ts
mycli plugins:uninstall PLUGIN...Removes a plugin from the CLI.
USAGE
$ mycli plugins uninstall PLUGIN...
ARGUMENTS
PLUGIN plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins uninstall myplugin
See code: src/commands/plugins/uninstall.ts
mycli plugins:uninstall PLUGIN...Removes a plugin from the CLI.
USAGE
$ mycli plugins unlink plugins:uninstall PLUGIN...
ARGUMENTS
PLUGIN plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins unlink myplugin
mycli plugins updateUpdate installed plugins.
USAGE
$ mycli plugins update [-h] [-v]
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Update installed plugins.
See code: src/commands/plugins/update.ts
Yeoman Environment handles the lifecycle and bootstrapping of generators in the Yeoman ecosystem. It provides functionalities to register, load, and run generators, which are similar to plugins in Oclif. However, it is more focused on scaffolding projects rather than managing CLI plugins.
Commander is a popular Node.js library for building command-line interfaces. While it does not have built-in support for managing plugins, it provides a flexible API for defining commands and options, which can be extended to support plugin-like functionality.
Inquirer is a library for creating interactive command-line prompts. It can be used in conjunction with other CLI frameworks to enhance user interaction. While it does not manage plugins directly, it can be integrated into a CLI application to provide a better user experience.
FAQs
plugins plugin for oclif
The npm package @oclif/plugin-plugins receives a total of 580,369 weekly downloads. As such, @oclif/plugin-plugins popularity was classified as popular.
We found that @oclif/plugin-plugins demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.