@tiptap/suggestion

Maintainerscaution

Four of six publishing accounts use the organization’s tiptap.dev domain, while _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts; this is a minor account-hygiene concern, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @tiptap/suggestion; this is understandable for a monorepo subpackage but still leaves package-to-repository linkage less explicit.

Workflow auditcaution

All 19 action references are unpinned, which weakens workflow reproducibility. A high-confidence template-injection finding and an ad hoc package install appear in publish.yml, but no untrusted trigger or script-injection path was reported, so these are workflow-hygiene concerns rather than standalone severe risk.