npm pack --dry-run tells you what you are about to publish
Most leaked secrets and 40 MB tarballs on the registry come from publishing a directory instead of a package. The dry run prints the exact file list and the unpacked size without uploading anything.
npm pack --dry-runRead that list before the first publish of anything. If it has test fixtures, a stray .env.local or your whole src/, add a files array to package.json and run it again. Patterns in files cannot be excluded by .npmignore, so an allowlist is the one thing you can audit in a second.
npmtooling