revealjs-presentation

This module is not an obvious self-contained malware payload, but it is a high-risk code generator. It ingests an arbitrary HTML file and (1) injects extracted HTML/CSS/SVG into a React component using dangerouslySetInnerHTML without sanitization and (2) extracts chart-related JavaScript from <script> blocks and inlines it into generated executable TSX logic. If the input presentation is attacker-controlled or comes from an untrusted source, this can enable XSS and arbitrary client-side logic execution in the resulting zo.space route. Additionally, it loads external CDN resources without integrity pinning, which is a supply-chain hygiene concern.