How do you respond when a dependency you use is reported as compromised?

Short interview answer

Determine which versions are affected and whether your lockfile pins one, pin to a known-good version or remove the package, rotate any secrets that were exposed to build environments during the window, and check whether the malicious code ran in production or only at build time.