@tiptap/extension-underline

Maintainerscaution

Four of six publish accounts use the organization’s tiptap.dev domain, but _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain publisher accounts; project backing makes this an account-hygiene caution rather than a maintenance-capacity concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. A monorepo mismatch is ordinary, but the lack of a README mention leaves some uncertainty about the package-to-repository link.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all 19 action references are unpinned and the publish workflow has high-confidence template-injection plus adhoc-package findings; these are workflow hygiene concerns without a dangerous trigger or broad write token.