@tiptap/extension-gapcursor

Maintainerscaution

Four of six registry publishing accounts use the organization domain, and the repository is organization-owned. The outside-domain accounts _bdbch (bdbch.com) and svenadlung (ueber.io) are account-hygiene concerns, but they do not undermine the observed contributor activity.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package, creating some uncertainty about package-to-repository mapping. The package is part of an organization-owned monorepo, so the name mismatch alone is not decisive, but the missing README mention remains a caution.

Workflow auditcaution

All 19 analyzed action references are unpinned, which is a workflow hygiene concern. The audit also found a high-confidence template-injection pattern and a low-confidence adhoc-package finding, but no untrusted checkout, script injection, or broad write permissions.