Nobody writes everything. Most of a modern program is other people's code, and one tool fetches it.
Package manager
Also called npm, Registry
A program that downloads code other people have published, from a public store called a registry, and keeps track of what you use. npm, pnpm and Bun do this for JavaScript, and pip and uv for Python. You run it in the terminal like anything else.
An install puts strangers' code on your machine, and some package managers let it run scripts as it installs. An agent types install as easily as ls, and it can name a package that doesn't exist, which an attacker could then register.
“Before you add a package, show me its registry page, its last publish date and why we need it. Say whether we could write it ourselves in under 20 lines. Install with bun add, with no --force and no sudo.”