
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
create-oclif
Advanced tools
This is a framework for building CLIs in Node.js. This framework was built out of the Heroku CLI but generalized to build any custom CLI. It's designed both for single-file CLIs with a few flag options, or for very complex CLIs that have subcommands (like git or heroku).
See the docs for more information.
The Getting Started tutorial is a step-by-step guide to introduce you to oclif. If you have not developed anything in a command line before, this tutorial is a great place to get started.
--help to the CLI to get help such as flag options and argument information. This information is also automatically placed in the README whenever the npm package of the CLI is published. See the multi-command CLI examplets-node to run the plugins enabling you to use TypeScript with minimal-to-no boilerplate needed for any oclif CLI.$ heroku info --app=<tab><tab> # will complete with all the Heroku apps a user has in their account
Currently, Node 8+ is supported. We support the LTS versions of Node. You can add the node package to your CLI to ensure users are running a specific version of Node.
With oclif you can create 2 different CLI types, single and multi.
Single CLIs are like ls or cat. They can accept arguments and flags. Single CLIs can optionally be a single file.
Multi CLIs are like git or heroku. They have subcommands that are themselves single CLIs. In the package.json there is a field oclif.commands that points to a directory. This directory contains all the subcommands for the CLI. For example, if you had a CLI called mycli with the commands mycli create and mycli destroy, you would have a project like the following:
package.json
src/
โโโ commands/
ย ย โโโ create.ts
ย ย โโโ destroy.ts
Multi-command CLIs may also include plugins.
Creating a single-command CLI:
$ npx oclif single mynewcli
? npm package name (mynewcli): mynewcli
$ cd mynewcli
$ ./bin/run
hello world from ./src/index.js!
Creating a multi-command CLI:
$ npx oclif multi mynewcli
? npm package name (mynewcli): mynewcli
$ cd mynewcli
$ ./bin/run --version
mynewcli/0.0.0 darwin-x64 node-v9.5.0
$ ./bin/run --help
USAGE
$ mynewcli [COMMAND]
COMMANDS
hello
help display help for mynewcli
$ ./bin/run hello
hello world from ./src/hello.js!
oclif command NAMEoclif help [COMMAND]oclif hook NAMEoclif multi [PATH]oclif plugin [PATH]oclif single [PATH]oclif command NAMEadd a command to an existing CLI or plugin
USAGE
$ oclif command NAME
ARGUMENTS
NAME name of command
OPTIONS
--defaults use defaults for every setting
--force overwrite existing files
See code: src/commands/command.ts
oclif help [COMMAND]display help for oclif
USAGE
$ oclif help [COMMAND]
ARGUMENTS
COMMAND command to show help for
OPTIONS
--all see all commands in CLI
See code: @oclif/plugin-help
oclif hook NAMEadd a hook to an existing CLI or plugin
USAGE
$ oclif hook NAME
ARGUMENTS
NAME name of hook (snake_case)
OPTIONS
--defaults use defaults for every setting
--event=event [default: init] event to run hook on
--force overwrite existing files
See code: src/commands/hook.ts
oclif multi [PATH]generate a new multi-command CLI
USAGE
$ oclif multi [PATH]
ARGUMENTS
PATH path to project, defaults to current directory
OPTIONS
--defaults use defaults for every setting
--force overwrite existing files
--options=options (yarn|typescript|eslint|mocha)
See code: src/commands/multi.ts
oclif plugin [PATH]create a new CLI plugin
USAGE
$ oclif plugin [PATH]
ARGUMENTS
PATH path to project, defaults to current directory
OPTIONS
--defaults use defaults for every setting
--force overwrite existing files
--options=options (yarn|typescript|eslint|mocha)
See code: src/commands/plugin.ts
oclif single [PATH]generate a new single-command CLI
USAGE
$ oclif single [PATH]
ARGUMENTS
PATH path to project, defaults to current directory
OPTIONS
--defaults use defaults for every setting
--force overwrite existing files
--options=options (yarn|typescript|eslint|mocha)
See code: src/commands/single.ts
If you have any suggestions or want to let us know what you think of oclif, send us a message at heroku-cli@salesforce.com
FAQs
oclif: create your own CLI
The npm package create-oclif receives a total of 88 weekly downloads. As such, create-oclif popularity was classified as not popular.
We found that create-oclif demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.ย It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.