Tampered Claude Code extension in Cursor planted an SSH backdoor Notebookcheck