You cannot call it a supply chain, if you have zero contractual relationships with the authors of the solutions you are using.
The grandparent’s point remains the same, the software ecosystem and its supply chain or however you want to call it is a hot mess.