Plugin registry or marketplace
Why it matters
Without a discovery mechanism, third-party plugins die in obscurity regardless of quality. Users resort to searching GitHub for unvetted repos, which fragments the ecosystem, delays adoption, and increases supply-chain risk because developers install whatever first result appears. A registry, naming convention like eslint-plugin-*, or curated list concentrates discovery into a trusted surface, which drives plugin author motivation, accelerates user-experience wins, and gives the core project a lever to flag abandoned or malicious extensions.
Severity rationale
Info because discovery is a growth and usability concern, not a security or correctness defect blocking release.
Remediation
Ship the cheapest discovery surface first: adopt a package-manager naming convention (for example my-app-plugin-* on npm) and publish a curated list of known plugins in docs/plugins.md or a JSON registry at src/plugins/registry.json. A minimal seed:
{ "plugins": [{ "name": "my-app-plugin-analytics", "description": "Analytics integration", "npm": "my-app-plugin-analytics" }] }
Link it from the README and the plugin-authoring guide so new authors know where to register.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Plugin / Extension Architecture Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from plugin-extension-architecture·automated