Yes, it can be steganography if the code is hidden or disguised to avoid detection but if it’s just inserted as active code, it may be looked at as malware or script injection, not steganography as malicious content is clearly visible in the file structure (e.g. have it's own script tag) 



