@tiptap/extension-underline

Maintainerscaution

Four of six publishing accounts use the organization domain, while _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts; this is a modest account-hygiene caution, not evidence of weak maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this exact package, creating a caution about linkage; the organization-backed monorepo context partly explains the name mismatch.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script-injection triggers; however, all 19 action references are unpinned, creating a workflow-hygiene caution. The high-confidence template-injection finding has no corroborating dangerous trigger here.