@tiptap/extension-subscript

Maintainerscaution

Four of six publishing accounts use the organization domain, but _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts. In an organization-backed project this is mainly account hygiene, not evidence of a thin maintenance team.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the link is less transparent. The package is plausibly a sub-package of the larger monorepo, but the collected evidence does not confirm that relationship.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, and no workflow has top-level write permissions. However, all 19 action references are unpinned, while the high-confidence template-injection and adhoc-package findings remain workflow hygiene concerns without a dangerous trigger corroborating them.