clean-pkg-json
Publishes only consumer-relevant package.json properties using an allowlist.
Setup
{
"scripts": {
"prepack": "clean-pkg-json"
}
}
When chaining with other prepack commands:
{
"scripts": {
"prepack": "pnpm build && clean-pkg-json"
}
}
Flags
| Flag |
Description |
Example |
-k, --keep |
Preserve additional properties |
clean-pkg-json -k eslintConfig,devDependencies |
-r, --remove |
Drop default-kept properties |
clean-pkg-json -r scripts.postinstall |
-d, --dry |
Preview result without writing to disk |
clean-pkg-json --dry |
-v, --verbose |
Log details about which properties are preserved |
clean-pkg-json --verbose |
Both --keep and --remove accept multiple flags (-k foo -k bar) or comma-delimited lists (-k foo,bar).
Use --dry to preview changes before writing.
npm pack --dry-run and npm publish --dry-run are also auto-detected (via npm_config_dry_run) — no write happens when npm itself is in dry-run mode.
Behavior
The tool reads ./package.json in the current directory, keeps only allowlisted properties, and writes the result back in place.
Scripts Handling
Scripts use dot-notation in the allowlist. Only install hooks are preserved by default:
scripts.preinstall
scripts.install
scripts.postinstall
scripts.dependencies
To preserve additional scripts:
clean-pkg-json --keep scripts.prepare
If no scripts remain after filtering, the scripts key itself is omitted.
Default Allowlist
| Category |
Properties |
| npm required |
name, version, private, publishConfig |
| Entry points |
main, bin, browser, man, files |
| Dependencies |
dependencies, peerDependencies, peerDependenciesMeta, bundledDependencies, optionalDependencies |
| Node.js ESM |
type, exports, imports |
| Environment |
engines, os, cpu |
| Metadata |
description, keywords, author, maintainers, contributors, license, homepage, repository, bugs, funding |
| TypeScript |
types, typings, typesVersions |
| Bundlers |
module, sideEffects |
| CDNs |
jsdelivr, unpkg |
| VSCode extensions |
sponsor, publisher, displayName, categories, galleryBanner, preview, contributes, activationEvents, badges, markdown, qna, extensionPack, extensionDependencies, extensionKind, icon |
| Angular |
fesm2022, fesm2020, fesm2015, esm2020, es2020 |
1---2name: clean-pkg-json3description: Cleans package.json for npm publishing using an allowlist approach — preserves only consumer-relevant properties. Use when setting up prepack hooks, configuring npm publish workflows, or working with clean-pkg-json flags.4---56# clean-pkg-json78Publishes only consumer-relevant `package.json` properties using an allowlist.910## Setup1112```json13{14 "scripts": {15 "prepack": "clean-pkg-json"16 }17}18```1920When chaining with other prepack commands:2122```json23{24 "scripts": {25 "prepack": "pnpm build && clean-pkg-json"26 }27}28```2930## Flags3132| Flag | Description | Example |33|------|-------------|---------|34| `-k, --keep` | Preserve additional properties | `clean-pkg-json -k eslintConfig,devDependencies` |35| `-r, --remove` | Drop default-kept properties | `clean-pkg-json -r scripts.postinstall` |36| `-d, --dry` | Preview result without writing to disk | `clean-pkg-json --dry` |37| `-v, --verbose` | Log details about which properties are preserved | `clean-pkg-json --verbose` |3839Both `--keep` and `--remove` accept multiple flags (`-k foo -k bar`) or comma-delimited lists (`-k foo,bar`).4041Use `--dry` to preview changes before writing.4243`npm pack --dry-run` and `npm publish --dry-run` are also auto-detected (via `npm_config_dry_run`) — no write happens when npm itself is in dry-run mode.4445## Behavior4647The tool reads `./package.json` in the current directory, keeps only allowlisted properties, and writes the result back in place.4849### Scripts Handling5051Scripts use dot-notation in the allowlist. Only install hooks are preserved by default:5253- `scripts.preinstall`54- `scripts.install`55- `scripts.postinstall`56- `scripts.dependencies`5758To preserve additional scripts:5960```sh61clean-pkg-json --keep scripts.prepare62```6364If no scripts remain after filtering, the `scripts` key itself is omitted.6566## Default Allowlist6768| Category | Properties |69|----------|------------|70| npm required | `name`, `version`, `private`, `publishConfig` |71| Entry points | `main`, `bin`, `browser`, `man`, `files` |72| Dependencies | `dependencies`, `peerDependencies`, `peerDependenciesMeta`, `bundledDependencies`, `optionalDependencies` |73| Node.js ESM | `type`, `exports`, `imports` |74| Environment | `engines`, `os`, `cpu` |75| Metadata | `description`, `keywords`, `author`, `maintainers`, `contributors`, `license`, `homepage`, `repository`, `bugs`, `funding` |76| TypeScript | `types`, `typings`, `typesVersions` |77| Bundlers | `module`, `sideEffects` |78| CDNs | `jsdelivr`, `unpkg` |79| VSCode extensions | `sponsor`, `publisher`, `displayName`, `categories`, `galleryBanner`, `preview`, `contributes`, `activationEvents`, `badges`, `markdown`, `qna`, `extensionPack`, `extensionDependencies`, `extensionKind`, `icon` |80| Angular | `fesm2022`, `fesm2020`, `fesm2015`, `esm2020`, `es2020` |