A package manager is a program that automates finding, installing, upgrading and removing software packages together with everything they depend on. Language ecosystems have their own, such as npm for JavaScript, pip for Python and Composer for PHP, while operating systems use tools like apt and Homebrew.
Why it matters
Without one, you would download libraries by hand and track versions yourself. A package manager resolves dependencies, records exact versions in a lock file and makes builds reproducible. It is also a security boundary, since installing a package runs someone else's code on your machine.
Example
$ npm install express
$ pip install requests==2.32.3
$ sudo apt install nginxThe first adds a library to a Node.js project, the second installs a specific Python version of a package, and the third installs a system program.
Common mistakes
- Installing packages with a name that is a slight misspelling of a popular one, a technique used in typosquatting attacks.
- Running installs with administrator rights when it is not needed.
- Ignoring audit warnings such as those from
npm audit.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.