@tiptap/extension-code

Maintainerscaution

Four of six registry publishing accounts use the organization domain, consistent with the organization-backed repository. _bdbch (bdbch.com) and svenadlung (ueber.io) use outside domains, which is an account-hygiene concern but not evidence of limited maintenance capacity.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script-injection triggers, but all 19 action references are unpinned. The high-confidence template-injection finding and an ad hoc package install in the publishing workflow add workflow hygiene risk, though no dangerous trigger or broad top-level write permission corroborates a severe impact.