Generate a log of all the installs on a system (whether apt-get/yum/pip/npm/...)
Software installation always requires authentication with sudo, regardless of which package manager you use, thus you can check /var/log/auth.log. There are multiple ones most recent are in plain text, older are compressed into gz archive, such as auth.log.4.gz. Use zgrep for those files.
The format is the following:
Oct 18 14:38:01 eagle sudo: xieerqi : TTY=pts/4 ; PWD=/home/xieerqi ; USER=root ; COMMAND=/usr/bin/apt-get update