A package manager lets you install, update, and remove pre-built code libraries with a single command, instead of downloading and configuring each one by hand. This guide covers what package managers actually do, using npm and pip as the two examples you’ll encounter constantly.
If you’ve worked through our guides on setting up your environment and the terminal, you’re ready to understand one more essential tool: the package manager, which you’ll rely on the moment your projects need external code.
What a Package Manager Actually Does
According to a comparison of package managers on Dev Community, a package manager automates installing, updating, configuring, and removing software packages — libraries, frameworks, or modules — for a specific language or system, handling dependency resolution automatically so you don’t have to track every piece by hand.
Without one, adding a library to your project would mean manually downloading it, figuring out which other libraries it depends on, downloading those too, and keeping every version compatible yourself — a genuinely tedious process that package managers eliminate entirely.
npm: JavaScript’s Package Manager
According to freeCodeCamp’s npm tutorial, npm (Node Package Manager) is the default package manager for JavaScript’s Node.js runtime, and it’s installed automatically alongside Node.js itself. As of recent counts, the npm registry hosts over 2 million packages — the largest single-language code repository in the world.
npm install expressThis single command downloads the Express library and all of its own dependencies, placing them in a folder called node_modules. According to W3Schools’ explanation of npm, every npm project is described by a package.json file — metadata listing the project’s name, version, and dependencies, generated automatically when you run npm init.
pip: Python’s Package Manager
Python’s equivalent is pip, which comes pre-installed with modern Python and interacts with the Python Package Index (PyPI) to find and install packages:
pip install requestsRather than a single package.json, Python projects conventionally list their dependencies in a requirements.txt file, often generated with pip freeze > requirements.txt — a snapshot of exactly which packages and versions are currently installed.
The package.json / requirements.txt Pattern
Both ecosystems share the same underlying idea: a text file listing your project’s dependencies, so anyone (including you, on a different computer) can recreate the exact same environment with one command — npm install or pip install -r requirements.txt — rather than installing each package individually by name.
Local vs. Global Installation
Packages can be installed locally (specific to one project, stored inside that project’s folder) or globally (available system-wide, for command-line tools you want accessible from anywhere). As a beginner, local installation is the safer default — it keeps each project’s dependencies isolated, so upgrading a package for one project can’t accidentally break a completely different one.
Why Version Numbers Matter
Package managers track exact version numbers, and for good reason: a library update can occasionally introduce breaking changes. Lock files — package-lock.json for npm — record the precise version of every installed package (including the dependencies of your dependencies), ensuring the exact same versions get installed every time, on every machine, rather than potentially different ones each time someone runs the install command.
Semantic Versioning: Reading Package Versions
Package versions typically follow a three-number pattern: major.minor.patch (like 4.17.1). According to Node.js’s own introduction to npm, npm follows the semantic versioning (semver) standard, which lets you specify not just an exact version but also acceptable ranges — for example, a caret symbol before a version number typically allows any newer minor or patch update within the same major version, automatically picking up bug fixes without risking a larger, potentially breaking change.
As a beginner, you don’t need to master semver’s full rules immediately, but recognizing the pattern helps when reading a dependency file or an error message about version conflicts.
A Practical Example: Setting Up a New Project
Here’s what starting a genuinely new JavaScript project with npm looks like end to end:
mkdir my-project
cd my-project
npm init -y
npm install lodashThe -y flag accepts npm’s default answers for the setup questions, creating a basic package.json immediately. The final command adds Lodash (a popular utility library) and records it as a dependency automatically. Running npm install with no package name afterward, on a different computer with the same package.json, recreates the exact same dependency set.
What Happens Behind the Scenes
When you run an install command, the package manager contacts its registry (npmjs.com for npm, PyPI for pip), downloads the requested package’s code along with anything that package itself depends on, and places everything in a designated folder — node_modules for npm projects. This recursive dependency resolution is exactly the tedious manual process package managers exist to eliminate; a single popular library can easily pull in dozens of smaller dependencies without you ever needing to track them individually.
Development vs. Production Dependencies
Not every package your project uses needs to ship to production. Tools like testing libraries, code formatters, or linters are only needed while you’re actively developing, not when your finished application actually runs. Both npm and pip support this distinction: npm separates these into “devDependencies” within package.json, while Python projects commonly use a separate file (like requirements-dev.txt) for development-only packages. Keeping this distinction clean matters more as projects grow, since it keeps your production deployment leaner, without dragging along tools nobody but you, the developer, actually needs at runtime.
Removing and Updating Packages
Package managers handle removal and updates just as easily as installation. Running npm uninstall package-name or pip uninstall package-name removes a package and updates the dependency file accordingly. Updating to newer versions is similarly straightforward — npm update or pip install --upgrade package-name — though it’s worth testing your project afterward, since even a minor version bump can occasionally introduce unexpected behavior in how a library works.
Package Managers Beyond JavaScript and Python
Nearly every programming language ecosystem has its own equivalent: Maven and Gradle for Java, Composer for PHP, RubyGems for Ruby, Cargo for Rust, NuGet for .NET. Each has its own specific commands and file formats, but they all share the same underlying goal covered throughout this guide — simplifying dependency management so developers don’t have to track every library and its dependencies manually. Once you understand the pattern behind npm and pip, picking up a new language’s package manager later is mostly a matter of learning its specific command names, not relearning the entire concept from scratch.
Common Questions
Do I need to memorize npm and pip commands? No — install, init, and checking a project’s dependency file cover most everyday use. More advanced commands can be looked up as needed.
Are third-party packages safe to install? Generally yes for popular, well-maintained ones, but it’s worth checking download counts and recent update activity before adding an unfamiliar package, since not every package on a public registry is equally trustworthy.
What if two packages need different versions of the same dependency? Package managers handle this automatically in most cases, installing separate copies as needed — a genuinely complex problem you rarely need to think about directly as a beginner.
Quick-Reference Guide
- npm — JavaScript’s package manager, tracks dependencies in package.json.
- pip — Python’s package manager, tracks dependencies in requirements.txt.
- install — the core command for adding a package to your project.
- Local installation — the safer default, isolates dependencies per project.
- Lock files — ensure the exact same package versions install every time.
Conclusion
Package managers remove an enormous amount of manual bookkeeping from software development — one command installs exactly what your project needs, dependencies and all. Whether you’re working in JavaScript or Python, the underlying pattern is the same: a dependency file, an install command, and a package manager handling the rest.
In the next guide in this series, we’ll cover setting up Node.js and npm specifically, step by step, for anyone ready to start JavaScript projects beyond the browser.
Explore More Tools & Setup Guides →
When not writing, Alex is probably debugging someone else’s code.