From a code review standpoint, I would reject the use of any installation that went outside of the code provided in the package at installation time, as this would provide a mechanism to

• identify users of the package
• inject some unknown, unreviewed chunk of code into the dev (prod - hopefully not) environment
• other creative attacks on an environment

Not saying that this is your intent, but use of that would be shot down in a heartbeat under any cursory review here.