npmignore

npm pack: How to Publish Without Leaking Secrets

npm pack builds the exact tarball that would be published to the registry. Using it before every publish is the simplest way to avoid shipping secrets.