npm Community Forum (Archive)

The npm community forum has been discontinued.

To discuss usage of npm, visit the GitHub Support Community.

Filename containing 'history' published besides not in whitelist

What I Wanted to Do

npm publish a package to a nexus server with a list of files in whitelisted package.json

What Happened Instead

A file was published that is not in that list of files. (history.ts)

Reproduction Steps

Create a folder, put in three files:

      "name": "test",
      "version": "0.0.1-SNAPSHOT",
      "description": "Whatever",
      "publishConfig": {
        "registry": "***"
      "files": [

If I run npm publish in that folder it published the history.ts file

npm notice === Tarball Contents ===
npm notice 259B package.json
npm notice 0    history.js
npm notice 0    history.ts


As soon as i rename the history.ts file to anything else not containing ‘history’ it works fine.
I also tried the same with a .npmignore file, which had a rule not to publish any .ts files, but history.ts was published in that case too.

Platform Info

$ npm --versions
{ 'test': '0.0.1-SNAPSHOT',
  npm: '6.4.1',
  ares: '1.15.0',
  cldr: '33.1',
  http_parser: '2.8.0',
  icu: '62.1',
  modules: '64',
  napi: '3',
  nghttp2: '1.34.0',
  node: '10.15.3',
  openssl: '1.1.0j',
  tz: '2018e',
  unicode: '11.0',
  uv: '1.23.2',
  v8: '',
  zlib: '1.2.11' }

$ node -p process.platform