Malicious NPM Packages Target Cursor AI's macOS Users