npm publish: include or exclude files

.gitignore

By default, .gitignore is used to determine what gets blacklisted during npm publish.

# .gitignore
dist/
.env*

But if .npmignore exists, then it takes precedence over .gitignore:

# .npmignore
dist/

Note: Do make sure all ignored files are included. Otherwise, you may accidentally publish things you did not intend.

In the example above, .env* is in .gitignore but not in .npmignore. This means files matching the .env* pattern will get published.

Ultimately, it’s better to whitelist what gets published with package.json’s files:

{
  "files": ["index.js", "/lib"]
}

To check what gets published, a local tarball can be generated:

npm pack