[timdorr]

I'm not a Python dev. Why would they do this? This is giving vibes of malware embedded into npm packages.

[skeledrew]

Convenient way to quickly add extra debugging capability without rerunning. It isn't much different from the many `curl example.com/install.sh |bash` you see around. It's up to the user to check things out before running.

[SOLAR_FIELDS]

Yeah, the piping to bash is a tried and true method for various installers. People make a fuss about it, but we don’t see people getting owned that way often. I think with bash installers though it’s pretty trivial to just visit the link and read through the 100 lines of bash. So anything installed this way should be as simple as visiting the link and reading a short amount of code imo

[etbebl]

Can't you just install it in your environment in another terminal and then import?

[CornCobs]

Not everywhere that python is run has access to pip. Sshing into some locked down remote machine and needing to debug some script is a use case that comes to mind.

[jampekka]

Pip install allows arbitrary code execution.