@tiptap/extension-placeholder

Maintainerscaution

Six publishing accounts are present, with four using the organization's tiptap.dev domain. The two outside-domain accounts, _bdbch and svenadlung, are account-hygiene cautions, while organization backing compensates for a short registry list.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating a linkage-transparency concern. The package is clearly presented as part of the broader Tiptap project, so this is a limited caution rather than a severe mismatch.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection trigger, and one scopes permissions at job level. However, all 19 action references are unpinned, and the publish workflow has high-confidence template-injection and adhoc-package findings; these are workflow hygiene concerns rather than evidence that the release is unfit.