gsap-scrolltrigger-storytelling

No explicit network exfiltration, credential access, or obvious malware mechanics are visible in the provided fragment. However, the module performs high-risk dynamic execution by decoding a Base64 HTML/JS blob and injecting it directly into an iframe via `srcdoc`, while also injecting runtime script URLs via string replacement and using wildcard `postMessage`. The security posture therefore depends heavily on the integrity of `encodedHtml` and the referenced runtime/assets. Treat this as a meaningful supply-chain/sandbox escape review hotspot rather than clearly benign demo code.