Claudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor