Malicious dependency in build pipeline

Your CI starts making unexpected outbound connections to an unknown host during npm ci, flagged by egress monitoring on the build runners. Nothing failed; builds are green. Investigation: a transitive dependency published a new patch version overnight containing a malicious post-install script that reads env vars (CI secrets) and exfiltrates them. Your lockfile allowed the patch bump because a recent dependency update loosened a pin, and the package's maintainer account was compromised. Some builds in the last 6 hours used the bad version and had access to deploy credentials. How do you triage what leaked, contain, and remediate the supply-chain exposure?