A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices