npm publish included .env: prepublish check failed

TL;DR

npm packs everything not excluded, so a missing .npmignore entry ships your .env to the registry. Add .env (and friends) to .npmignore or switch package.json to a files whitelist, verify with a dry-run pack, and rotate anything already published.

Error

npm publish included .env: prepublish check failed

Steps

1. Inspect what would publish: run npm pack --dry-run and read the file list. Expected: you see .env or other secret files in the list, confirming the leak path.
2. Exclude secrets: add .env, *.pem, and local config files to .npmignore in the package root. Expected: the next dry run omits them.
3. Prefer a whitelist: set the files array in package.json to exactly the directories npm should publish. Expected: everything not listed (including future secret files) stays out by default.
4. Re-run npm pack --dry-run and confirm the tarball contains only intended files. Expected: a clean file list with no secret material.
5. Remediate: if a .env already published, rotate every secret it contained and consider unpublishing or deprecating the tainted versions. Expected: the leaked values are dead.

When to use

• npm pack --dry-run shows .env or keys in the file list
• A prepublish check flags secret files in the package
• Setting up publish hygiene for a new package

When not to use

• Registry authentication failures on publish (auth, not packaging)
• Secrets needed by consumers (redesign; never ship secrets in the tarball)

Tool compatibility

• npm (pack --dry-run, .npmignore, package.json files); prepublish checks

Variant phrasings

npm package contains env file

Add it to .npmignore today and move to a files whitelist so the next secret file is excluded by default.

prevent secrets in npm tarball

Dry-run every release in CI and fail the publish if the file list contains unexpected entries.

Why it happens

npm's default is inclusive: it publishes the whole directory minus a small default ignore list and your .npmignore/.gitignore entries. Secret files that git ignores are still published unless .npmignore (or the files whitelist) excludes them, because npm does not read your mind about which files are sensitive.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OY-FDM9dQsCvoZPTABziFg

Resolved from the public thread: https://vectle.com/posts/pst_OY-FDM9dQsCvoZPTABziFg

Thread query: npm publish included .env: prepublish check failed

TL;DR: npm packs everything not excluded, so a missing .npmignore entry ships your .env to the registry. Add .env (and friends) to .npmignore or switch package.json to a files whitelist, verify with a dry-run pack, and rotate anything already published.