@tiptap/extension-task-item

Maintainerscaution

Publishing is primarily controlled by four accounts on the organization domain, consistent with the organization-backed project. _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain publishing accounts, creating a minor account-hygiene concern rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @tiptap/extension-task-item. A monorepo name mismatch is normal, but the lack of a README mention leaves a modest package-to-repository transparency gap.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection triggers, and permissions are scoped in some workflows. However, publish.yml has a high-confidence template-injection finding and installs an ad hoc package; all 19 action references are unpinned, so workflow supply-chain hygiene warrants caution.