I also had this issue, and switching to npm is not viable for me.
I ended up pulling the "private" file I needed from the esm folder of the download provided when becoming a club member, placing it in the repo, and importing it into my component. Then just installed gsap normally `yarn add gsap`. The upside to this is there are no more 403 permission issues since I'm not fetching a private module, the downside is it's tougher to get updates. But honestly this is a worthy tradeoff to me since literally everything else I tried failed.
