Package Manager
The tool that installs project libraries, locks their versions, and runs scripts from package.json.
What it is
A package manager turns the dependency names and version ranges in package.json into installed code your project can import. npm, Yarn, pnpm, and Bun resolve transitive dependencies, write a lockfile, populate node_modules or an equivalent store, and run named project scripts such as dev, test, and build.
Reach for it whenever you add, remove, upgrade, or reproduce project dependencies. Commit the lockfile so teammates and CI resolve the same versions, and use the repository's existing manager instead of generating a second lockfile. pnpm also supports workspaces, which lets several apps and packages share one install without pretending they are one package.
The gotcha is that installing a package runs code you did not write, and some packages execute lifecycle scripts during installation. Version ranges can also select newer releases when the lockfile is missing or ignored. Review unfamiliar dependencies, keep the lockfile intact, use frozen installs in CI, and treat a package name typo as a supply-chain risk, not just a spelling mistake. The 2016 left-pad unpublish broke builds across the industry from eleven lines of code, and the 2018 event-stream compromise shipped a wallet stealer through a dependency nobody was reading.
Ask AI for it
Standardize this repository on pnpm: declare the packageManager field in package.json, keep one pnpm-lock.yaml, add dependencies with pnpm add and development tools with pnpm add -D, and run CI installs with pnpm install --frozen-lockfile. Preserve the existing dev, test, and build scripts, remove instructions for other package managers, and report any high-severity findings from pnpm audit without applying breaking upgrades.