Slopsquatting: DPRK Squats Packages Your LLM Hallucinates

The Mechanism Is Boring, Which Is Why It Works

An LLM suggests import requests-auth-helper; the package does not exist yet, but a week later someone publishes it on npm or PyPI after watching suggestion logs or enumerating plausible names. The next agent run installs it, the payload executes at install time, and the developer never typed the name.

The attacker does not need to guess what you will mistype. The model guesses for them.

Call it hallucination-squatting at scale: one model, used by millions of developers, emits the same plausible-but-nonexistent name often enough that squatting it is a reliable yield. North Korean APT groups noticed before security teams did.

Why Existing Controls Fail

The failure mode compounds with MCP STDIO vulnerabilities disclosed this week: 150M+ affected downloads across 30+ disclosures and 10+ CVEs from one root cause in the Model Context Protocol transport layer. The framing layer parses untrusted bytes before any model code runs, so a hostile tool response reaches a local shell before anyone reads a prompt.

The DAEMON Tools incident shows legitimate code signing certificates can be compromised. C2 ran over QUIC for 28 days undetected because most network monitoring treats QUIC as "UDP/443, probably Chrome," so the install looked signed and trusted while the payload executed anyway.

The Fix Is Three Controls, None Default

1. Lockfile verification in CI: reject any package not already in your manifest without explicit human approval, and gate AI-generated dependency additions specifically.
2. Registry allowlist at the network layer: for fully agentic workflows (Devin-style), sandbox execution with registry allowlisting so the agent cannot reach arbitrary packages.
3. Install-time sandboxing: so a malicious setup.py cannot read ~/.aws/credentials on first run. Socket.dev flags newly-published packages, and lockfile-lint enforces pre-approved manifests.

Cross-Source Pattern

Five independent sources flagged overlapping aspects of this threat this week, and the convergence tells the story: agent autonomy scales faster than agent auditing. The vector varies across slopsquatted packages, MCP STDIO RCE, and certificate-compromised installers, but the pattern holds: install-time code execution moved inside the agent loop, while lockfile gates and network allowlists stayed where they were a year ago.

PAN-OS CVE-2026-0300: The Firewall Is the Foothold

Buffer overflow in the management plane, confirmed exploited in the wild, with scanning live before most teams finished standup. No misconfiguration required. Exposure is the bug. If the management interface is reachable from anything not under your own control, that is the fire.

Patch ETA is mid-to-late May, which is two more weeks of exposure on the late end. The only mitigation is access restriction: VPN, IP allowlist, or offline.

The perimeter device is only a perimeter while it is not the foothold.

Post-compromise behavior follows a pattern. Persistence lands on the appliance itself, because rebooting a firewall does not feel like incident response. Check logs for unexpected admin sessions, new config commits, and outbound connections to anything that is not a known update endpoint.

cPanel: 44,000+ Hosts, 64-Day Window

CVE-2026-41940 (CVSS 9.8), a CRLF injection auth bypass in cPanel/WHM, was exploited for 64 days before disclosure. The tally: 7,135 hosts with ransomware, 15,448 hosts participating in attacks in a single day, and a Mirai variant deployed for DDoS. "Sorry" ransomware uses ChaCha20 (fast, no AES-NI dependency on older shared hosts) with RSA-2048 key wrapping. Textbook and unbreakable without the key.

The real failure is inventory. The cPanel box someone spun up for a marketing site three years ago. The staging environment inherited from an acquisition. Without a complete cPanel inventory there is no claim of safety.

DAEMON Tools: Signing Trust Is Not Safety

A valid certificate chain and the real distribution source delivered malware for 28 days. Signing proves provenance, not intent. When the loader presents a valid chain to a trusted root, EDR code-integrity checks return true and telemetry gets downgraded to noise.

CISA's Response: 3-Day Patching

CISA is floating compression of the remediation window from 14 days to 3. Three days is not a patch window. It is a release pipeline requirement. If production deploy currently takes a week, the math does not work. Release engineering needs emergency paths that are actually tested, not runbook entries that have never been exercised.