All @tiptap/extension-collaboration-cursor versions
@tiptap/extension-collaboration-cursor @2.26.3
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
35
Risk Score
—
License
No
Install Scripts
0
Dependencies
2
Dev Dependencies
6.2 KB
Package Size
Published
Maintainers
patrickbabertimoisik_bdbchsvenadlungtiptap-bot
Keywords
tiptaptiptap extension
Dev Dependencies (2)
| Package | Constraint | Registry Status |
|---|---|---|
| @tiptap/core | ^2.26.3 | auto_approved |
| y-prosemirror | ^1.2.12 | auto_approved |
Changes from v2.26.2
No metadata changes detected.
File Changes
0 added
0 removed
1 modified
size delta: +.0 KB
Risk Dispositions (1 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression is a strong account-compromise signal for this package; should generalize until attestations are restored. |
SAST Findings (1)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
Review Summary
Risk score: 35. Findings: 1 high (+25), 1 medium (+10).
Commit: 7fc8d8144395 Browse source
Published to npm: