There&#x27;s an easy way to prevent credential leakage when publishing to npm =&gt; Explicitly list the files to include in the package through the `files` property in package.json.<p>Docs: <a href="https:&#x2F;&#x2F;docs.npmjs.com&#x2F;files&#x2F;package.json#files" rel="nofollow">https:&#x2F;&#x2F;docs.npmjs.com&#x2F;files&#x2F;package.json#files</a><p>Example: <a href="https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;got&#x2F;blob&#x2F;2f5d5ba94d625802880b3c793c3c1aa7798d0533&#x2F;package.json#L29-L31" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sindresorhus&#x2F;got&#x2F;blob&#x2F;2f5d5ba94d625802880...</a>