ioc: 1 new compromise candidate(s)

[brian93512]

Automated IOC compromise candidates generated from OSV ecosystem feeds for the last 24 hours.

Review each entry carefully:

• Does this read like a real supply-chain compromise or malicious publish, rather than an ordinary CVE?
• Is the version pinning exact and narrow enough?
• Is BLOCK the right action, or should this be downgraded to WARN?
• Is the reason clear enough for someone triaging a finding?

Close this PR if any candidate looks like a normal vulnerability that should stay in AS-004 / OSV instead of the manual blacklist.

[brian93512]

Closing this generated IOC candidate because it promotes a generic deserialization vulnerability into the manual AS-008 compromise blacklist. AS-004/OSV should cover normal vulnerabilities; the offline blacklist should stay limited to confirmed supply-chain compromise or malicious package versions.