@tiptap/extension-image

Maintainerscaution

Four of six publishing accounts use the organization domain, consistent with organization-backed publishing. The outside-domain accounts _bdbch (bdbch.com) and svenadlung (ueber.io) are an account-hygiene caution, though they do not by themselves indicate weak maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @tiptap/extension-image. This is plausible for a monorepo, but the absence of either reference leaves package-to-repository identification less explicit.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script-injection findings, or broad top-level write permissions. However, all 19 action references are unpinned, and the publish workflow has high-confidence template-injection and high-confidence ad hoc package-install findings; these are workflow hygiene concerns rather than evidence of a compromised release.