A booby-trapped version of the Claude Code extension was served to Cursor users for about 11 hours on October 29.