Sounds like Friday was a lot of fun with https://news.ycombinator.com/item?id=15256121 And we all knew that keeping a history of the installed packages in a prod environment is important. If you're flexible enough to let PIP install packages, I wonder if it's practical to try to recognize the 1 unique squatted-like package?