discovered 2026-07-23
Per-package config file; hex-decodes to the exfil domain oob.sl4x0.xyz plus a per-package DNS tag (goldman1 for gs-uitk-object-utils, goldman2 for gs-uitk-testing-utils) used to correlate DNS beacons back to a specific package.
