Installing a Package with pip

Beyond the standard library sits PyPI, the Python Package Index: a public collection of several hundred thousand packages that anyone can install and anyone can publish. The tool that installs them is pip, which comes with Python. It turns weeks of work into one command, and because anyone can publish, it deserves a little care.

Think of an app store for code. It is enormous, most of what is in it is good, and some of the best tools in the world live there. It is also open to anyone, so you check the publisher and the exact name before you install, exactly as you would with an app.

PyPI and pip

With your project's virtual environment active, install a package with python -m pip install followed by its name. The book's example is requests, the most widely used package for talking to web services, which Chapter 10 uses. pip finds it on PyPI, works out which other packages it needs, downloads all of them into the environment, and finishes with a line listing what it installed.

(.venv) you@mac python-course % python -m pip install requests
...
Successfully installed certifi-2026.7.22 charset_normalizer-3.5.1 idna-3.20 requests-2.34.2 urllib3-2.8.0

Before that last line, pip prints a list of what it is collecting and downloading; the three dots stand for it. Your version numbers will almost certainly be newer, because packages are updated constantly. Notice that one request brought five packages: requests depends on four others, called its dependencies, and pip installed them too.

Seeing What Is Installed

python -m pip list shows every package in the environment with its version. In a fresh environment with one package installed, the list is short, which is the point of having an environment per project.

(.venv) you@mac python-course % python -m pip list
Package            Version
------------------ ---------
certifi            2026.7.22
charset-normalizer 3.5.1
idna               3.20
pip                26.2.1
requests           2.34.2
urllib3            2.8.0

requirements.txt

The virtual environment itself is disposable; the list of what it contains is what you keep. python -m pip freeze prints every installed package with its exact version, in a format pip can read back. Save that output to a file called requirements.txt, and anyone, including you on another computer, can recreate the same environment with python -m pip install -r requirements.txt. The greater-than sign in the first command sends the output into the file instead of the screen.

(.venv) you@mac python-course % python -m pip freeze > requirements.txt
(.venv) you@mac python-course % python -m pip install -r requirements.txt

certifi==2026.7.22
charset-normalizer==3.5.1
idna==3.20
requests==2.34.2
urllib3==2.8.0

Care: Names Are Easy to Fake

Because anyone can publish to PyPI, attackers regularly upload packages whose names are one typo away from popular ones, hoping someone will mistype the name. A package called reqeusts, with two letters swapped, or request, without the final s, is not requests, and installing it can run the attacker's code on your computer. This is a real and recurring attack, called typosquatting.

The defences are simple. Copy the install command from the package's own official documentation instead of typing it from memory. Check the name on its PyPI page, which also shows who maintains it and when it was last updated. And prefer a well-known package that is actively maintained over an obscure one that does the same job, because every package you install is code you have decided to trust.