What is a Package Manager?

What package managers do

Without a package manager, to use someone else’s code you’d have to:

1. Find the code
2. Download it
3. Put it in the right place
4. Update it manually when new versions come out
5. Track what version you’re using
6. Repeat for every library

Package managers automate all of this:

npm install axios   # Downloads axios, tracks version in package.json
pip install flask   # Downloads Flask and its dependencies
cargo add serde     # Downloads serde crate

The main package managers

JavaScript/Node.js

npm (Node Package Manager)

• Comes with Node.js
• Most widely used
• Registry: npmjs.com

npm install package-name     # Install a package
npm install                  # Install all packages from package.json
npm uninstall package-name   # Remove a package
npm update                   # Update packages
npm run dev                  # Run scripts defined in package.json

yarn

• Alternative to npm
• Slightly faster
• Same registry as npm

yarn add package-name
yarn                         # Same as npm install
yarn remove package-name

pnpm

• Faster and uses less disk space
• Growing in popularity

pnpm install package-name
pnpm install

Python

pip

• Comes with Python
• Registry: pypi.org

pip install package-name
pip install -r requirements.txt  # Install from file
pip uninstall package-name
pip freeze > requirements.txt    # Save installed packages

poetry / pipenv

• More modern Python package managers
• Better dependency resolution
• Built-in virtual environment management

Others

Key concepts

package.json (JavaScript)

This file defines your project and its dependencies:

{
  "name": "my-project",
  "version": "1.0.0",
  "scripts": {
    "dev": "next dev",
    "build": "next build"
  },
  "dependencies": {
    "react": "^18.2.0",
    "axios": "^1.6.0"
  },
  "devDependencies": {
    "typescript": "^5.0.0"
  }
}

• dependencies: Packages needed to run your app
• devDependencies: Packages only needed during development (testing, building)
• scripts: Commands you can run with npm run <script-name>

Lock files

Lock files record the exact versions installed:

Always commit lock files to Git. They ensure everyone gets identical versions.

Version numbers

Packages use semantic versioning: MAJOR.MINOR.PATCH (e.g., 2.3.1)

• MAJOR: Breaking changes (2.x → 3.x might break your code)
• MINOR: New features, backwards compatible (2.3 → 2.4)
• PATCH: Bug fixes (2.3.0 → 2.3.1)

In package.json, prefixes control what gets installed:

node_modules

When you run npm install, packages go into the node_modules folder. This folder:

• Can be huge (hundreds of MB)
• Contains thousands of files
• Should NOT be committed to Git
• Can be regenerated anytime from package.json + lock file

Add to .gitignore:

node_modules/

Common workflows

Starting a new project

# JavaScript
npm init -y                  # Creates package.json
npm install react next       # Install packages

# Python
python -m venv venv          # Create virtual environment
source venv/bin/activate     # Activate it (Mac/Linux)
pip install flask            # Install packages
pip freeze > requirements.txt

Cloning an existing project

git clone https://github.com/user/repo.git
cd repo

# JavaScript
npm install                  # Installs everything from package.json

# Python
pip install -r requirements.txt

Adding a package

# JavaScript (production dependency)
npm install axios

# JavaScript (dev dependency)
npm install -D typescript

# Python
pip install requests

Updating packages

# See what's outdated
npm outdated

# Update all
npm update

# Update a specific package
npm install axios@latest

Removing a package

npm uninstall axios
pip uninstall requests

Common problems

“npm install” fails

# Delete and reinstall
rm -rf node_modules package-lock.json
npm install

# If it's a permissions issue (Mac/Linux)
sudo chown -R $(whoami) ~/.npm

Wrong Node version

Some projects need specific Node versions. Use nvm (Node Version Manager):

# Install nvm, then:
nvm install 18
nvm use 18

Conflicting dependencies

npm install --legacy-peer-deps
# or
npm install --force

Python virtual environment issues

Always use virtual environments to avoid conflicts:

# Create
python -m venv venv

# Activate (Mac/Linux)
source venv/bin/activate

# Activate (Windows)
.\venv\Scripts\activate

# Now pip installs go to this environment only
pip install flask

The registry

Packages live in registries:

• npmjs.com: Browse JavaScript packages
• pypi.org: Browse Python packages
• crates.io: Browse Rust packages

Before installing a package, check:

• Download count (popular = probably safe)
• Last updated (actively maintained?)
• GitHub stars and issues
• Security advisories

Package manager commands cheat sheet

Further reading

• What is a dependency? : Understanding what gets installed
• Common error messages explained : When npm fails
• What is an environment variable? : Configuration alongside packages