ioc: 4 new compromise candidate(s)

[brian93512]

Automated IOC compromise candidates generated from OSV ecosystem feeds for the last 24 hours.

Review each entry carefully:

• Does this read like a real supply-chain compromise or malicious publish, rather than an ordinary CVE?
• Is the version pinning exact and narrow enough?
• Is BLOCK the right action, or should this be downgraded to WARN?
• Is the reason clear enough for someone triaging a finding?

Close this PR if any candidate looks like a normal vulnerability that should stay in AS-004 / OSV instead of the manual blacklist.

[brian93512]

Closing this generated IOC candidate because these are generic CVE/RCE/arbitrary-write/command-injection vulnerabilities rather than confirmed supply-chain compromise or malicious package versions. They should remain AS-004/OSV coverage, not manual AS-008 blacklist entries.