@tiptap/extension-heading

Maintainerscaution

The package has six publish-access accounts, with four using the organization domain; _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts, which is a minor account-hygiene concern, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @tiptap/extension-heading, creating a provenance/linkage concern. The large repository file tree indicates a monorepo, which partly explains the name mismatch but not the absent README mention.

Workflow auditcaution

All three workflows were analyzed and no untrusted checkout or script-injection sink was found, but all 19 action references are unpinned. The high-confidence template-injection finding and low-confidence adhoc-package finding are hygiene concerns in the publish workflow without a dangerous trigger or sink shown.