The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.