So the hackers stole every environment variable for the context in which the Codecov script was run.

It means that if you use CI to deploy your code, all of your credentials have been leaked.