Profile My skills Saved Collections Edit profile Submit a skill

Secrets Bundled in Published Packages

Detects API keys, private keys, and credentials accidentally included in npm/pip packages via missing .npmignore or .pypiignore.

zakirkun Updated
Integrations & APIs

File contents

Secrets Bundled in Published Packages

Overview

When publishing packages without a proper .npmignore or explicit files field in package.json, sensitive files like .env, *.pem, and test credentials get included in the published artifact and become visible to anyone who installs the package.

Remediation

  • Add .npmignore with patterns for .env, *.key, *.pem, test/, secrets/
  • OR use the files field in package.json to explicitly list only publishable files
  • Run npm publish --dry-run to see what will be included

zakirkun/ice-tea/tree/main/skills/supply-chain/bundled-secrets commit 23560d0ace

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/secrets-bundled-in-published-packages