npmleak-ci
Simulate what npm pack/npm publish actually ships, and catch what
your files/.npmignore/.gitignore config is failing to
exclude before a .env file or a private key becomes permanently public on the
registry.
- Free, no key needed: checks whether a top-level
.envfile would be included. Source at https://github.com/growaleaf/npmleak-ci. - Pro ($9, one time): computes the full package contents the way npm
actually resolves them (
filesfield, or.npmignore/.gitignorefallback), reports total size and largest included files, and flags every.env*, key/cert file, and SSH private key that would ship. Offline-checked license key — no subscription, no per-seat pricing, no telemetry.
Source is readable at the repo above before you buy.