beautiful-shadows

The module dynamically decodes an embedded HTML template and injects it into an iframe via `srcdoc`, then loads (optionally) local media assets and passes base64-encoded assets into the iframe using `postMessage` with `targetOrigin='*'`. No explicit credential theft or external exfiltration is evident in the shown fragment, but the encoded-payload + `srcdoc` execution pattern and wildcard messaging are notable security risks that require inspection of the fully decoded HTML and verification of iframe sandboxing and receiver-side origin/type checks.