Package Managers: npm, Yarn, pnpm and More

A package manager is a tool that automates the installation, updating, and removal of libraries and programs, resolving dependencies consistently. In the JavaScript ecosystem, npm, Yarn, and pnpm dominate; Chocolatey and Homebrew do the same on Windows and macOS.

• What is a package manager?
• npm, Yarn, or pnpm: which to choose?
• How does npm work?
• Yarn: the alternative that popularized the lockfile
• Why does pnpm save disk space?
• How to install programs on Windows with Chocolatey?
• How does Homebrew work on macOS?
• Other managers: Pip, Conda, RubyGems, and NuGet
• Conclusion

What is a package manager?

A package manager is software that installs, updates, configures, and removes libraries, tools, and applications automatically. It resolves a project dependency tree — each package may depend on dozens of others — and ensures all environments use exactly the same versions, from the developer laptop to the production server.

In practice, the package manager reads a manifest file (such as package.json) and writes a lockfile with the exact installed versions. Combined with semantic versioning, this mechanism lets you update dependencies predictably and reproduce the same environment on any machine, which makes collaboration between developers much safer.

npm, Yarn, or pnpm: which to choose?

For most JavaScript projects, npm is the default choice because it comes installed with Node.js and has the largest ecosystem. pnpm is the best option when installation speed and disk savings matter — a typical case for monorepos and CI (Continuous Integration) pipelines. Yarn remains solid in codebases that already adopted it.

The numbers confirm this hierarchy: according to the Stack Overflow Developer Survey 2025, npm is used by 56.8% of responding developers, versus 21.1% for Yarn and 13.4% for pnpm. Among system managers, Homebrew appears with 25.7% and Chocolatey with 11%.

How does npm work?

npm (Node Package Manager) works in two parts: a public registry that hosts the packages and a command-line tool that installs, publishes, and updates those libraries in Node.js projects. The official npm documentation defines it as "the world's largest software registry".

The workflow revolves around package.json: the npm install command reads the dependencies declared there, downloads the packages from the registry, and records the exact versions in package-lock.json. npm also runs build, test, and publish scripts, covering everything from basic utilities to full frameworks.

The ecosystem also includes npx, which runs packages without requiring global installation — here at CodeCrush we already published a guide on npx and running npm packages.

Yarn: the alternative that popularized the lockfile

Yarn was created in 2016 by Facebook to solve speed and consistency problems that npm had at the time. Yarn introduced the deterministic lockfile (yarn.lock), offline cache, and parallel package installation — ideas so successful that npm itself incorporated them in subsequent versions.

Today, modern Yarn (known as Yarn Berry) goes further: it offers the Plug'n'Play mode, which eliminates the traditional node_modules folder, and native workspaces for monorepos. For teams that already rely on these features, Yarn remains a productive and reliable choice, even though its usage share has been shrinking as pnpm advances.

Why does pnpm save disk space?

pnpm saves space because it stores each package version a single time in a content-addressed global repository and creates hard links to each project node_modules, instead of duplicating files — the mechanism is described in the pnpm motivation documentation. Ten projects that use the same dependency share a single copy on disk.

Speed follows the savings: in the official pnpm benchmarks, a clean install that takes 31.3 seconds with npm is completed in 7.7 seconds with pnpm. This difference, multiplied by hundreds of CI builds per day, explains why pnpm became the favorite of large-scale monorepos.

How to install programs on Windows with Chocolatey?

Chocolatey is a package manager for Windows that installs, updates, and removes programs through a CLI (command-line interface), bringing to Windows an experience equivalent to Unix systems. The basic flow has four steps:

1. Open PowerShell as administrator.
2. Run the installation script available in the official Chocolatey documentation.
3. Install programs with a single command, such as choco install nodejs.
4. Update everything at once with choco upgrade all.

Those who do not yet master PowerShell can start with our guide on fundamental terminal commands for Windows, Linux, and Mac — Chocolatey becomes much more powerful when combined with machine provisioning scripts.

How does Homebrew work on macOS?

Homebrew installs software on macOS (and Linux) through formulas: scripts written in Ruby that describe where to download each program and how to compile or install it. With a single command, such as brew install git, the user gets the tool and all its dependencies resolved automatically.

The official Homebrew site summarizes the proposition: install what you need that Apple did not include in the system. In addition to formulas for command-line tools, Homebrew offers casks, which install full graphical applications — from browsers to code editors — keeping everything updatable with brew upgrade.

Other managers: Pip, Conda, RubyGems, and NuGet

Outside the JavaScript universe and operating systems, each ecosystem has its reference manager:

1. Pip — the default Python manager, integrated with PyPI (Python Package Index). It is the usual path to install libraries like NumPy and TensorFlow.
2. Conda — geared toward data science, it manages isolated virtual environments and simplifies the installation of complex libraries like pandas and scikit-learn.
3. RubyGems — distributes gems in the Ruby ecosystem, essential in Ruby on Rails applications, such as Devise for authentication.
4. NuGet — the .NET world manager, used to integrate libraries like Entity Framework and ASP.NET Core.

The lesson is the same in every case: choosing the right tool for the project context and using it consistently is worth more than any personal preference.

Conclusion

Package managers are invisible infrastructure: when well chosen, no one notices they exist. The practical recommendation is straightforward — use npm by default, switch to pnpm when install time or disk space become a bottleneck, and standardize on Chocolatey or Homebrew to provision team machines. The costly mistake is not choosing the "wrong" tool, but mixing managers in the same project or leaving the lockfile out of version control.