With HN ettiquette in mind, I must make an exception: this is a case where skimming the first parts of the article would help a lot!

The public repo path is just one of four parallel paths, with the goal of getting around any barriers:

  The exfiltration component shares its design with the "Mini Shai-Hulud" mechanism from their last campaign, using four parallel channels so stolen data gets out even if individual paths are blocked.