Malicious Claude Code Extension Slipped an SSH Backdoor Into Cursor's Marketplace XenoSpectrum