Package manager
Also known as: package management system, software package manager, package managers
A package manager is a tool that installs, updates, and removes software automatically, keeping track of which versions are installed and what other components, called dependencies, each program needs.
Operating system package managers include apt on Ubuntu, winget on Windows, and Homebrew on macOS, while developers use language-specific ones such as npm for JavaScript and pip for Python. While package managers make software easy to install and keep updated, they've also become a target for attackers who publish malicious packages.
Package manager, explained at three levels
At home
A package manager is like an app store you use by typing. You ask for a program by name, and it fetches, installs, and updates it for you.
At work
Package managers let IT teams install and update software consistently across many computers.
At home
On Windows, typing 'winget upgrade --all' in a terminal updates many installed apps at once. On a Mac, Homebrew does similar jobs.
At work
Developers' projects can depend on hundreds of packages. Lock files pin exact versions, and tools scan dependencies for known vulnerabilities.
At home
Attackers publish packages with names similar to popular ones, a trick called typosquatting. In my opinion, double-check spelling before installing anything from the command line.
At work
Use private package mirrors or proxies, pin and verify versions, generate software bills of materials, scan dependencies continuously, and require multi-factor authentication for maintainers publishing packages.
Real-world examples
At home
Marcus set up a new laptop. Instead of downloading installers one by one, he used winget to install his browser, media player, and editor in minutes.
At work
Nadia leads development at a Toronto software firm. She set up a private npm proxy that blocks packages with known malware before developers can install them.
How it compares
| feature | Package manager | App Store |
|---|---|---|
| Install method | Command or script | Tap or click |
| Dependencies | Handled automatically | Bundled in each app |
| Main users | IT and developers | Everyone |
| Automation | Easy | Limited |
App stores suit everyday users. Package managers suit automation.
For analysts
In software development projects, I'd include dependency management in risk registers. Third-party packages are code you didn't write but still ship.
History & origin
Linux distributions pioneered package managers in the 1990s, with Debian's dpkg in 1994, Red Hat's RPM in 1997, and Debian's APT in 1998, which automatically resolved dependencies. Perl's CPAN in 1995 started the trend of language package repositories, followed by Python's PyPI in 2003, Homebrew for Macs in 2009, and npm for JavaScript in 2010. Microsoft released winget for Windows in 2020. Attacks grew alongside them: in 2018 the popular npm package event-stream was hijacked to steal cryptocurrency, and in September 2025 a self-spreading worm dubbed 'Shai-Hulud' compromised hundreds of npm packages. In my view, package managers are wonderful conveniences that require the same trust decisions as installing any software.