@tiptap/extension-task-list

Maintainerscaution

Four of six publishing accounts use the organization’s tiptap.dev domain, consistent with the organization-backed project. The outside-domain accounts _bdbch (bdbch.com) and svenadlung (ueber.io) are account-hygiene cautions, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. Because this is an organization monorepo, the name mismatch is understandable, but the lack of a README mention leaves some package-to-repository linkage ambiguity.

Workflow auditcaution

All three workflows were analyzed without failures and no untrusted checkout or script-injection sinks were found. However, the publish workflow has a high-confidence template-injection finding, all 19 action references are unpinned, and it installs a package outside a lockfile; these are meaningful release-workflow hygiene concerns.