'We don't know who deployed this': Squid distances itself from $3.2 million third-party module exploit