I have a private module stored on github that I'm including in one of my projects using npm. The module has a .npmignore file, but nothing is being ignored when I install or update the module.

Project's package.json

{
  "name": "Your Cool Project",
  "version": "0.0.0",
  "dependencies": {
    "myModule" : "git+ssh://[email protected]:user/myModule.git",
    /* All your other dependencies */
  }
  ...
}

Module's .npmignore file

.git*
gulpfile.js
index.html
tests.js
README.md

When I run npm update myModule these files are still being downloaded into my project. Am I missing something? Does .npmignore work for privately hosted modules? Thanks in advance.

I have a private module stored on github that I'm including in one of my projects using npm. The module has a .npmignore file, but nothing is being ignored when I install or update the module.

Project's package.json

{
  "name": "Your Cool Project",
  "version": "0.0.0",
  "dependencies": {
    "myModule" : "git+ssh://[email protected]:user/myModule.git",
    /* All your other dependencies */
  }
  ...
}

Module's .npmignore file

.git*
gulpfile.js
index.html
tests.js
README.md

When I run npm update myModule these files are still being downloaded into my project. Am I missing something? Does .npmignore work for privately hosted modules? Thanks in advance.

• javascript
• node.js
• npm

• 7 It is to be noted that README is always included, even if listed in .npmignore. See docs – Aurelio Commented Mar 14, 2015 at 16:54
• 4 You can use npm publish --dry-run to be sure what's going online. – Yauheni Prakopchyk Commented Nov 5, 2018 at 5:39
• 1 Note that if you have a main property in your package.json and you try to ignore a directory that the path assigned to main is in, npm publish will include it. Idk the nuances of how this works, I just discovered it through experimenting. Doesn't seem to be documented anywhere that I've found. – derpedy-doo Commented Jan 16, 2020 at 3:52

2 Answers 2

Since you're specifying the dependency myModule as a Git repository, npm is probably just cloning the repo. Therefore your .npmignore files isn't being used.

.npmignore seems to be used when "making modules" eg: pack or publish not consuming modules (like in your example).

Be careful when using .npmignore

If you haven't been using .npmignore, it defaults to .gitignore with a few additional sane defaults.

What many don't realize that once you add a .npmignore file to your project the .gitignore rules are (ironically) ignored. The result is you will need to audit the two ignore files in sync to prevent sensitive leaks when publishing.

Still, I think is missing put the /node_modules in your .npmignore.

Set the attribute private: true in package.json file as below:

{
  "name": "project-name",
  "version": "0.0.0",
  "license": "MIT",
  "scripts": {
  },
  "private": true,
  "dependencies": {
  },
  "devDependencies": {
  }
}

Generate the build into /public folder to publish it to NPM repository with .npmignore into that folder.