@tiptap/extension-superscript

Maintainerscaution

Six publishing accounts are listed, with four using the organization domain. The outside-domain accounts _bdbch (bdbch.com) and svenadlung (ueber.io) are account-hygiene cautions, though the organization backing and active repository contributors compensate for limited registry-account evidence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. This is consistent with a monorepo subpackage, but the lack of an explicit README mention leaves a small provenance-transparency gap.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection trigger, but all 19 action references are unpinned. The publish workflow also has a high-confidence template-injection finding and installs a package outside a lockfile, so workflow hygiene is a real caution.