I agree, but in my opinion you shouldn’t be downloading it from PyPI every time you use it in that case, or one day you’ll end up leftpad.js-ed or node-ipc-ed.

I agree, but in my opinion you shouldn’t be downloading it from PyPI every time you use it in that case, or one day you’ll end up leftpad.js-ed or node-ipc-ed. It can be hard to work out when it’s the right time to commit a “done” version of a dependancy into your own repo, but the risks of not doing so are real and have bitten many people.