Can I inspect the contents of an npm package before publish? - node.js

Question

I would like to be able to run a script on the contents of a npm package before it gets published to see if all the required files are presents. We recently had some published packages that were missing things as they had wrongfully been matched by patterns in .npmignore.
Is this possible? Will npm install . -g essentially do this by placing the exact same contents in /usr/local/lib/node_modules/mypackage as on NPM?

Answer 1

npm pack --dry-run will output the to-be-published files to stderr, without doing any changes to the filesystem.
npm notice 📦 #some/package#0.2.38
npm notice === Tarball Contents ===
npm notice 641B package.json
npm notice 961B src/index.js
npm notice === Tarball Details ===
npm notice name: #some/package
npm notice version: 0.2.38
npm notice filename: some-package-0.2.38.tgz
npm notice package size: 1 kB
npm notice unpacked size: 1.5 kB
npm notice shasum: somesha
npm notice integrity: someothersha
npm notice total files: 2
You could assert on that list of files with a file that doesn't exist, e.g.
> npm pack --dry-run 2>&1 >/dev/null | grep src/someFileNotInPackage.js
> echo $?
1
Notice the 1, an error exit code.
Or on a file that does exist:
> npm pack --dry-run 2>&1 >/dev/null | grep src/index.js
> echo $?
0
Notice the 0, success exit code.

Answer 2

This scripts checks for the files you pass in as params:
#!/bin/bash
# Checks to see if the published NPM package has the files passed in as arguments
# Requirements: jq and npm
# `brew install jq` on macOS and `apt install jq` on Ubuntu
pkg=$(echo $(jq .name package.json)-$(jq .version package.json).tgz | sed 's/"//g')
files_to_check="$#"
main(){
npm pack > /dev/null 2>&1;
check_tarball_files $#
rm $pkg > /dev/null;
}
usage(){
cat << EOF
Usage: check-files-present [file1 [file2 [...]]]
Example. Want to see that 'lolex' contains two specific files:
check-files-present src/lolex-src.js package/lolex.js
EOF
exit 1
}
if [[ $# == 0 ]]; then
echo No file names given on command line
usage
fi
check_tarball_files(){
tarball_files=$(tar tf $pkg)
for f in $files_to_check; do
if !(echo $tarball_files | grep package/$f) > /dev/null; then
echo "Missing $f" && exit 1
fi
done
echo All files present: $files_to_check
}
main
Gist

Answer 3

I run npm pack && tar -xvzf *.tgz | cut -c9- && rm -rf package *.tgz with Git Bash on Windows to list all files to be included in the published package.
For example, running the script on the axios repository:
git clone https://github.com/axios/axios.git
cd axios
npm install
npm run build
Pack, extract the archive, trim package/ prefix and cleanup afterward:
npm pack && tar -xvzf *.tgz | cut -c9- && rm -rf package *.tgz
This results in a list of files included in the package to be deployed:
axios-0.19.0.tgz
LICENSE
dist/axios.js
lib/axios.js
lib/core/Axios.js
dist/axios.min.js
lib/helpers/bind.js
lib/core/buildFullPath.js
lib/helpers/buildURL.js
lib/cancel/Cancel.js
lib/cancel/CancelToken.js
lib/helpers/combineURLs.js
lib/helpers/cookies.js
lib/core/createError.js
lib/defaults.js
lib/helpers/deprecatedMethod.js
lib/core/dispatchRequest.js
lib/core/enhanceError.js
lib/adapters/http.js
index.js
lib/core/InterceptorManager.js
lib/helpers/isAbsoluteURL.js
lib/cancel/isCancel.js
lib/helpers/isURLSameOrigin.js
lib/helpers/isValidXss.js
lib/core/mergeConfig.js
lib/helpers/normalizeHeaderName.js
lib/helpers/parseHeaders.js
lib/core/settle.js
lib/helpers/spread.js
lib/core/transformData.js
lib/utils.js
lib/adapters/xhr.js
package.json
dist/axios.map
dist/axios.min.map
CHANGELOG.md
lib/adapters/README.md
lib/core/README.md
lib/helpers/README.md
README.md
UPGRADE_GUIDE.md
index.d.ts
The first line should be skipped as it is the name of the archive (package and version).