Caught in the Hook: RCE and API Token Exfiltration Through Claude Code · HackerTrans