Package Manager
Package Manager
What is a package manager?
- A tool for installing and managing external libraries
- npm, pip, etc.
- Dependency management
What a package manager really changes is not how you “fetch” libraries but how you “record” them. It used to be that everyone downloaded the files they needed and copied them into the project folder, and a few months later nobody could explain who had added which version, or why. Now the repository holds only a list of the parts you need instead of the parts themselves, and a command does the actual installation. So when a new developer starts on day one, downloads the repository, and runs a single install command, they get exactly the same development environment as their senior colleagues.
The most common point of confusion in practice is the difference between the declaration file and the lock file. If package.json says `^4.17.1`, that means “whatever is newest within 4.x,” so running the same command yesterday and today can install different versions. Lock files such as package-lock.json or poetry.lock pin every one of those versions, and on deployment servers teams use a ci-style command instead of install so that only what the lock file specifies gets installed. Teams also separate development-only packages, such as testing tools, from those that ship to production, and companies that undergo security audits run an internal proxy repository (Nexus, Artifactory) that lets only approved packages through.
Problems usually come from three places. First, treating the lock file as an auto-generated artifact and adding it to .gitignore. Many “it works on my PC but fails only on the server” cases start here. Second, AI confidently suggesting package names that don’t actually exist. Attackers sometimes claim those plausible-sounding names in advance and upload malicious code, so before installing, check the weekly download count and the last update date yourself. Third is licensing. If you include a GPL-family library in a product you deliver to a client, you may be required to release your source code, which becomes a problem at the contract stage. If you forget that a single command can pull in hundreds of indirect dependencies, code you never wrote ends up within your product’s accountability.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ lectures, who gets non-specialists using AI right away
John KimJohn Kim, CEO of Nanum Consulting and author of “B2B Marketing Design”It evolved into a tool that automates dependency installation, and npm (JavaScript), launched in 2010, built the world’s largest package ecosystem and brought the approach into the mainstream.
Consider a hypothetical case. Company A, a food-ingredient distributor with 180 employees, decided to move its branch ordering process, which ran on manual Excel files, to an internal web service. With no outsourcing, two developers built it themselves over four months. Development went smoothly, but every deployment to the production server produced an unexplained error. Over three weeks, all 5 deployments failed, and the launch slipped by two weeks.
- When the development team lead dug through the logs, they found that the same install command had put version 4.17 on the developers’ PCs but version 4.18 on the production server. The root cause: the lock file that pins versions was missing from the repository.
- The developer in charge said, "I thought it was an auto-generated file that didn’t need to be uploaded." The team lead removed the lock file from .gitignore so it would be committed, and changed the install command in the deployment script to the ci command, which installs only exactly what the lock file specifies.
- The information security officer ran a vulnerability scan and found 12 issues. Two were high-risk and were resolved that same week by upgrading the affected libraries. The other 10 were development-only packages, so they were logged as having no production impact.
- While vetting 7 packages suggested by an AI coding tool, the team found 1 name that doesn't actually exist. They set 'at least 10,000 weekly downloads and an update within the last 6 months' as the pre-install check and posted it on the wiki.
- While scanning licenses, the team found one GPL-family library, and after legal review replaced it with an MIT-licensed alternative package. Because the service is distributed for use at branches, leaving it in place could have led to a demand to release the source code.
- In the three months after the cleanup, there were 0 failures caused by environment differences across 21 deployments, and the time to set up a new developer’s environment dropped from half a day to 20 minutes.