Vetting the Black Box: A Supply Chain Due Diligence Framework for AI and ML

In March 2026, a poisoned LiteLLM release sat live on PyPI for 40 minutes; long enough to reach three million downloads. The publisher was trusted. The artifact was not. Most AI teams have a process for neither. This article provides one.