Is there any new information on how the attack works? Was it something that's injected at compile time (the Xcode building the app store version was compromise

Is there any new information on how the attack works? Was it something that's injected at compile time (the Xcode building the app store version was compromised for all these apps?)? Was it just files added to the project if anyone on the team used the compromised Xcode?