
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@oclif/plugin-plugins
Advanced tools
plugins plugin for oclif
This plugin is used to allow users to install plugins into your oclif CLI at runtime. For example, in the Heroku CLI this is used to allow people to install plugins such as the Heroku Kafka plugin:
$ heroku plugins:install heroku-kafka
$ heroku kafka
This is useful to allow users to create their own plugins to work in your CLI or to allow you to build functionality that users can optionally install.
One particular way this is useful is for building functionality you aren't ready to include in a public repository. Build your plugin separately as a plugin, then include it as a core plugin later into your CLI.
First add the plugin to your project with yarn add @oclif/plugin-plugins, then add it to the package.json of the oclif CLI:
{
"name": "mycli",
"version": "0.0.0",
// ...
"oclif": {
"plugins": ["@oclif/plugin-help", "@oclif/plugin-plugins"]
}
}
Now the user can run any of the commands below to manage plugins at runtime.
To make it simpler for users to install plugins, we have "friendly name" functionality. With this, you can run mycli plugins:install myplugin and it will first check if @mynpmorg/plugin-myplugin exists on npm before trying to install myplugin. This is useful if you want to use a generic name that's already taken in npm.
To set this up, simply set the oclif.scope to the name of your npm org. In the example above, this would be mynpmorg.
Note that in the above example, the plugin prefix defaults to plugin. If you're setting the scope, you can also override the plugin prefix using oclif.pluginPrefix.
For example, let's say oclif.scope is set to mynpmorg and oclif.pluginPrefix is set to myprefix. When you run mycli plugins:install myplugin, it will first check if @mynpmorg/myprefix-myplugin exists on npm before trying to install myplugin.
Over time in the Heroku CLI we've changed plugin names, brought plugins into the core of the CLI, or sunset old plugins that no longer function. There is support in this plugin for dealing with these situations.
For renaming plugins, add an alias section to oclif.aliases in package.json:
"aliases": {
"old-name-plugin": "new-name-plugin"
}
If a user had old-name-plugin installed, the next time the CLI is updated it will remove old-name-plugin and install new-name-plugin. If a user types mycli plugins:install old-name-plugin it will actually install new-name-plugin instead.
For removing plugins that are no longer needed (either because they're sunset or because they've been moved into core), set the alias to null:
"aliases": {
"old-name-plugin": null
}
old-name-plugin will be autoremoved on the next update and will not be able to be installed with mycli plugins:install old-name-plugin.
mycli pluginsmycli plugins add PLUGINmycli plugins:inspect PLUGIN...mycli plugins install PLUGINmycli plugins link PATHmycli plugins remove [PLUGIN]mycli plugins resetmycli plugins uninstall [PLUGIN]mycli plugins unlink [PLUGIN]mycli plugins updatemycli pluginsList installed plugins.
USAGE
$ mycli plugins [--json] [--core]
FLAGS
--core Show core plugins.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
List installed plugins.
EXAMPLES
$ mycli plugins
See code: src/commands/plugins/index.ts
mycli plugins add PLUGINInstalls a plugin into mycli.
USAGE
$ mycli plugins add PLUGIN... [--json] [-f] [-h] [-s | -v]
ARGUMENTS
PLUGIN... Plugin to install.
FLAGS
-f, --force Force npm to fetch remote resources even if a local copy exists on disk.
-h, --help Show CLI help.
-s, --silent Silences npm output.
-v, --verbose Show verbose npm output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into mycli.
Uses npm to install plugins.
Installation of a user-installed plugin will override a core plugin.
Use the MYCLI_NPM_LOG_LEVEL environment variable to set the npm loglevel.
Use the MYCLI_NPM_REGISTRY environment variable to set the npm registry.
ALIASES
$ mycli plugins add
EXAMPLES
Install a plugin from npm registry.
$ mycli plugins add myplugin
Install a plugin from a github url.
$ mycli plugins add https://github.com/someuser/someplugin
Install a plugin from a github slug.
$ mycli plugins add someuser/someplugin
mycli plugins:inspect PLUGIN...Displays installation properties of a plugin.
USAGE
$ mycli plugins inspect PLUGIN...
ARGUMENTS
PLUGIN... [default: .] Plugin to inspect.
FLAGS
-h, --help Show CLI help.
-v, --verbose
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Displays installation properties of a plugin.
EXAMPLES
$ mycli plugins inspect myplugin
See code: src/commands/plugins/inspect.ts
mycli plugins install PLUGINInstalls a plugin into mycli.
USAGE
$ mycli plugins install PLUGIN... [--json] [-f] [-h] [-s | -v]
ARGUMENTS
PLUGIN... Plugin to install.
FLAGS
-f, --force Force npm to fetch remote resources even if a local copy exists on disk.
-h, --help Show CLI help.
-s, --silent Silences npm output.
-v, --verbose Show verbose npm output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into mycli.
Uses npm to install plugins.
Installation of a user-installed plugin will override a core plugin.
Use the MYCLI_NPM_LOG_LEVEL environment variable to set the npm loglevel.
Use the MYCLI_NPM_REGISTRY environment variable to set the npm registry.
ALIASES
$ mycli plugins add
EXAMPLES
Install a plugin from npm registry.
$ mycli plugins install myplugin
Install a plugin from a github url.
$ mycli plugins install https://github.com/someuser/someplugin
Install a plugin from a github slug.
$ mycli plugins install someuser/someplugin
See code: src/commands/plugins/install.ts
mycli plugins link PATHLinks a plugin into the CLI for development.
USAGE
$ mycli plugins link PATH [-h] [--install] [-v]
ARGUMENTS
PATH [default: .] path to plugin
FLAGS
-h, --help Show CLI help.
-v, --verbose
--[no-]install Install dependencies after linking the plugin.
DESCRIPTION
Links a plugin into the CLI for development.
Installation of a linked plugin will override a user-installed or core plugin.
e.g. If you have a user-installed or core plugin that has a 'hello' command, installing a linked plugin with a 'hello'
command will override the user-installed or core plugin implementation. This is useful for development work.
EXAMPLES
$ mycli plugins link myplugin
See code: src/commands/plugins/link.ts
mycli plugins remove [PLUGIN]Removes a plugin from the CLI.
USAGE
$ mycli plugins remove [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins remove myplugin
mycli plugins resetRemove all user-installed and linked plugins.
USAGE
$ mycli plugins reset [--hard] [--reinstall]
FLAGS
--hard Delete node_modules and package manager related files in addition to uninstalling plugins.
--reinstall Reinstall all plugins after uninstalling.
See code: src/commands/plugins/reset.ts
mycli plugins uninstall [PLUGIN]Removes a plugin from the CLI.
USAGE
$ mycli plugins uninstall [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins uninstall myplugin
See code: src/commands/plugins/uninstall.ts
mycli plugins unlink [PLUGIN]Removes a plugin from the CLI.
USAGE
$ mycli plugins unlink [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ mycli plugins unlink
$ mycli plugins remove
EXAMPLES
$ mycli plugins unlink myplugin
mycli plugins updateUpdate installed plugins.
USAGE
$ mycli plugins update [-h] [-v]
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Update installed plugins.
See code: src/commands/plugins/update.ts
Yeoman Environment handles the lifecycle and bootstrapping of generators in the Yeoman ecosystem. It provides functionalities to register, load, and run generators, which are similar to plugins in Oclif. However, it is more focused on scaffolding projects rather than managing CLI plugins.
Commander is a popular Node.js library for building command-line interfaces. While it does not have built-in support for managing plugins, it provides a flexible API for defining commands and options, which can be extended to support plugin-like functionality.
Inquirer is a library for creating interactive command-line prompts. It can be used in conjunction with other CLI frameworks to enhance user interaction. While it does not manage plugins directly, it can be integrated into a CLI application to provide a better user experience.
FAQs
plugins plugin for oclif
The npm package @oclif/plugin-plugins receives a total of 401,179 weekly downloads. As such, @oclif/plugin-plugins popularity was classified as popular.
We found that @oclif/plugin-plugins demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.