This has been a puzzle for a while, and I am not yet satisfied with the answer so far. The closest to an explanation is found here: https://ciexinc.com/blog/solarwinds-articles/initial.html.

I feel like this says "well, we are not really sure".

It’s kinda-sorta in the article. The hackers managed to put some hack into the Solarwinds build scripts.

Nice writing I guess, but, what allowed them to get into the build scripts?

Tim Brown VP Security of Solarwinds said: “We check code out of source code control, have a TeamCity environment to kick off the build, and here the attacker looked for Orion to be built and swapped a file. It was a transient virtual machine and that’s hard to detect,” he said.

https://itwire.com/security/solarwinds-speaks-out,-and-softw...

So it sounds like the VM host they were running builds upon was compromised - or maybe JetBrains was compromised?

JetBrains claims there is no evidence they were compromised https://blog.jetbrains.com/blog/2021/01/07/an-update-on-sola...

The wiki page on the attack speculates an Office360 account was hacked. Presumably it was an account from an admin, and from there I could see them probing until finding credentials for the build system.