AFAIK most malware like this first sends the contents of your environment variables, ssh keys, passwords, etc. to the server, and then sets up a persistent process that executes arbitrary commands received from the attacker's server at any time, allowing them to run whatever else they want

You can actually test it yourself. The actual URL is in the post and the website is still up.

Compromise of developer's access, API keys, etc. in order to create a supply chain attack.

Arbitrary remote code execution, maybe sold to the highest bidder like some shady cloud provider?

This has happened to me, it was an attack that was trying to get crypto private keys (ethereum)