@tiptap/extension-list

Maintainerscaution

Four of six publishing accounts use the tiptap.dev domain, consistent with the organization-backed repository. _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain publishing accounts, which is a modest account-hygiene concern but not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @tiptap/extension-list. The monorepo structure and package file tree make a subpackage relationship plausible, but the package-specific linkage is less explicit.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection trigger, and permissions are not broadly write-enabled. However, publish.yml has a high-confidence template-injection finding, and all 19 action references are unpinned; the low-confidence-free audit is complete, so these are genuine workflow hygiene concerns.