Comment by botch_san

Pinning the SHA package hash would help? I am not too familiar with Python dependency management, so not sure if this is supported.