A tampered Claude Code extension in Cursor's marketplace installed an SSH backdoor on up to 5,000 developers' machines. Here ...