 Why are third-party package addresses always invalid???