A malicious Claude Code extension on Open VSX carried a hidden backdoor, putting developers' machines at risk.