Are there maven-plugins that should not be used in opensource projects?

  • Because their license restricts that
  • Because they add code


In other words: Is it save to ignore the plugins when looking for license restrictions?

Update: bmargulies's answer is what I feared but:

Q: Is there an actual plugin that I could not use in a non-open project distributed to customers ?

  • Are talking really about plugins to Maven or regular Jars available through Maven? And is this correct that you are talking about the Maven Central repo? Jun 12, 2016 at 16:23

2 Answers 2


It's not really possible to answer the question about the existence of a maven plugin, somewhere, in some repository. Not all Maven plugins are even on Maven central.

A maven plugin could, certainly, plop a lump of IP into your project with a license that is incompatible with your needs. And no protocol in Maven forces a plugin to announce this in any obvious way.

In the absolute worst case, some jerk could hide some proprietary content in a plugin and deposit it in binary in your output, and then later come around and claim that what you've built is a derived work and you owe, you owe.

At the end of the day, you're never completely safe in the land of open source unless you, well, read the source. If you are going to use a Maven plugin that is not from one of the mainstream sources, you would be well-advised to take a gander at its source even if you aren't worried about some sort of unpleasant IP implant.

There's a sort of trivial example in the form of the maven-archetype-plugin. It generates source code from templates licensed under the terms of the Apache License. Someone could claim that this makes the generated code into a derived work of the template, and subject to the terms of the AL. Or, worse, someone could push a template with some troublesome license, and nothing in the archetype plugin warns you when you select an archetype as to what the licensing is.

  • so it is possible. Do you know of any such plugin ?
    – openCage
    Jun 27, 2016 at 12:41

The archetype plugin creates sources from an apache-licensed template. from an extreme viewpoint, that is an examples.

  • but apache-licensed should not create a problem, right ? I am looking for a known malicious plugin.
    – openCage
    Aug 2, 2016 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.