Your package was compromised. How do you prove which version you actually shipped?

Last week, LiteLLM got owned. Not the company. Not the code. The publishing pipeline. An attacker...