Downloaded packages and used in a DXP are attached to the file or to the library.
When the package is updated, analyst or any other client, should alert a new version is available and even provide the option to update to the latest version.