strike extension for tiptap
82%
Total Score
healthy
Active project, but its publish workflow has a high-confidence template-injection finding and all 19 actions are unpinned.
Four of six publishing accounts use the primary tiptap.dev domain, while _bdbch uses bdbch.com; that outside-domain publishing account is a modest account-hygiene concern, not evidence of a thin maintenance team.
The linked repository name does not match the package name and its README does not mention @tiptap/extension-strike. This may simply reflect a monorepo subpackage, but the signal leaves package-to-repository identity less explicit.
All 3 workflows were analyzed without failures and have no untrusted checkouts or script injection, but publish.yml has a high-confidence template-injection finding and all 19 action references are unpinned. The additional low-confidence adhoc-packages finding is a smaller hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.