@tiptap/extension-gapcursor

Maintainerscaution

Four of six registry publishers use the organization domain, but _bdbch (bdbch.com) and svenadlung (ueber.io) use outside domains, creating some account-hygiene risk despite clear organization backing.

Workflow auditcaution

All 19 action references are unpinned, which weakens build reproducibility. The publish workflow also has high-confidence template-injection and low-severity ad hoc package findings, although no untrusted checkout or script-injection path was detected.