A fake Claude Code extension on Cursor could expose 5,000+ users to data theft and hacking. Here's what happened and how to stay safe.