# wpm — WordPress package manager > [!quote] > "Forget about npm here, because it's the package manager for JavaScript and it won't help [with WordPress]… composer is another package manager just like npm but it's for PHP." Lovekesh Kumar introduces WPM to give WordPress unified dependency management — private plugins, integrity verification, automatic dependencies — positioned against the npm/Composer analogy. ## Source - [Reader: Talk Devy To Me — wpm with Lovekesh Kumar](https://read.readwise.io/read/01ktwh1c55fv83mnk56yzxsajn) *(vault source note pending next Readwise sync)* ## Links - [[3. Resources/Permanent Notes/Zet · WordPress lacks a unified package manager]] — evidence-for: WPM's private-package, integrity, and dependency features make the missing unified WordPress dependency contract concrete - [[3. Resources/Literature Notes/Lit · WordPress site sync is unsolvable in general]] — because applies-in: the missing-registry problem this note names (no unified way to declare a plugin's dependencies) is the same root cause that makes general site-to-site sync unsolvable — both are symptoms of WordPress never having formalized an environment/dependency contract - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: the MOC lists this note under Connected Literature Notes (synthesis sweep 2026-07-14).