The article/twitter thread don't offer anything definitive. It could be this leaked password was how their supply chain got compromised, it might not be.

Just anecdotally I'm looking at my own release infrastructure and it would take a bit more work to get compromised binaries to our customers than a leaked secret in a public git repo - and if it was reported that we leaked some key or password that gave the keys of the kingdom away, it would be trivial to change it and verify that we didn't push malware.

This article can explain how malware made it into a download server, maybe. But does it explain the fact the malware was signed? Maybe, but that suggests a bigger fuck up than leaking a password.