BookNest names two dependencies, express and pg, yet installing them puts 82 packages on disk, because Express 24,430 alone depends on 28 packages, several with dependencies of their own. These transitive dependencies come from dozens of authors you never chose. Versions also conflict: Express 5.2.1 wants content-type@^1.0.5, while three packages it uses want content-type@^2.x, so two versions must be installed side by side (1).
Done by hand, this means downloading tarballs, reading manifests and unpacking folders for every patch release; Windows developers called the result "DLL hell." A package manager makes it mechanical: resolve each range to one version (Dependency Resolution), fetch and verify each archive against its hash (Registries and Mirrors), then link and record, laying packages out on disk and writing a lockfile. The tools in this chapter differ mostly in that last step.