Package Management

A team of 200 engineers had 15 internal libraries scattered across private Git repos, shared drives, and npm links to local paths. Nobody knew which version was current. Three teams maintained their own forks of the same utility library, each with different bug fixes. When a security vulnerability was found in the base library, patching required tracking down every fork and every project using it. It took two weeks.

Package management solves this by publishing internal code to a registry (npm, PyPI, Maven, or a private alternative). Versioned, discoverable, installable with a single command. One source of truth.

npm alone serves over 2 billion package downloads per day. Maven Central hosts 550,000+ unique artifacts. PyPI has 400,000+ projects. These registries are the distribution backbone of modern software.

Private registries. Every organization beyond a few developers should have one. It prevents internal code from leaking to public registries, provides access control, and enables dependency caching (faster installs, resilience to public registry outages).

Verdaccio runs as a simple Node.js process and acts as a caching proxy for npm. It stores internal packages locally and forwards public package requests to the real npm registry. Setup takes 5 minutes. GitHub Packages and GitLab Package Registry integrate with the hosting platform, so publishing happens in CI with no additional infrastructure.

When NOT to create a package. When the code is only used by one project. Creating a package adds versioning overhead, release processes, and documentation requirements. If only one consumer exists, a local module is simpler.