@tiptap/extension-superscript

Maintainerscaution

Four of six publishing accounts use the organization domain, consistent with the organization-backed project. The outside-domain accounts _bdbch (bdbch.com) and svenadlung (ueber.io) are a minor account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this exact package. Although this may be a monorepo subpackage, the missing explicit linkage warrants caution when confirming source ownership.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection trigger, and one scopes permissions at job level. However, all 19 action references are unpinned; the high-confidence template-injection finding has no corroborating dangerous trigger, while adhoc package installation is low-severity hygiene.