New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details →
Socket
Book a DemoSign in
Socket

@libria/clean-publish

Package Overview
Dependencies
Maintainers
1
Versions
5
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@libria/clean-publish

A CLI tool for publishing clean npm packages

latest
Source
npmnpm
Version
1.1.1
Version published
Maintainers
1
Created
Source

@libria/clean-publish

A CLI tool for publishing clean npm packages. Stage only the files you need, sanitize your package.json, and publish a minimal, production-ready package.

Why?

When you publish a package to npm, you often include unnecessary files like tests, source code, configs, and development scripts. This tool lets you:

  • Copy only the files you want to publish (using glob patterns)
  • Remove devDependencies, scripts, and other fields from package.json
  • Preview what will be published before actually publishing
  • Skip publishing when nothing has changed (hash-based detection)

Version License

Installation

npm install -D @libria/clean-publish

Or use it directly with npx:

npx @libria/clean-publish <command>

Quick Start

# Initialize config file
lb-clean-publish init

# Preview what will be staged
lb-clean-publish dry-run

# Stage files for publishing
lb-clean-publish build

# Publish to npm
lb-clean-publish publish

Commands

CommandDescription
initCreate a .clnpb.json config file
buildStage files to temp directory and sanitize pkg
dry-runPreview matched files and package.json rules
packGenerate an npm tarball from staged files
publishPublish staged files to npm registry

All commands accept optional paths to operate on multiple directories:

lb-clean-publish build projects/libA projects/libB
lb-clean-publish publish projects/libA projects/libB

Configuration

Create a .clnpb.json file in your project root (or run lb-clean-publish init):

{
  "tmpDir": ".tmp-clean-publish",
  "copy": [
    "dist/**",
    "README.md",
    "LICENSE"
  ],
  "packageJson": {
    "remove": {
      "scripts": true,
      "devDependencies": true
    }
  }
}

Config Options

tmpDir

Type: string

Directory where files are staged before publishing.

copy

Type: string[]

Glob patterns for files to include in the published package. Uses fast-glob syntax.

packageJson

Rules for sanitizing package.json:

OptionTypeDescription
remove.scriptsbooleanRemove all scripts
remove.devDependenciesbooleanRemove devDependencies
remove.optionalDependenciesbooleanRemove optionalDependencies
keepScriptsstring[]Scripts to keep when remove.scripts is true
removeFieldsstring[]Additional top-level fields to remove

Example: Keep specific scripts

{
  "tmpDir": ".tmp-clean-publish",
  "copy": ["dist/**", "README.md"],
  "packageJson": {
    "remove": {
      "scripts": true,
      "devDependencies": true
    },
    "keepScripts": ["postinstall"]
  }
}

Example: Remove custom fields

{
  "tmpDir": ".tmp-clean-publish",
  "copy": ["dist/**", "README.md"],
  "packageJson": {
    "remove": {
      "scripts": true,
      "devDependencies": true,
      "optionalDependencies": true
    },
    "removeFields": ["prettier", "eslintConfig", "jest"]
  }
}

Workflow

  • Build your project - Compile TypeScript, bundle, etc.
  • Run lb-clean-publish build - Stages files to temp directory
  • Run lb-clean-publish pack (optional) - Creates a tarball to inspect
  • Run lb-clean-publish publish - Publishes to npm

The publish command automatically skips if nothing has changed since the last publish (using content hashing).

Multi-Project Support

You can run commands on multiple directories from a single location. Each directory should have its own .clnpb.json and package.json.

# Build multiple projects
lb-clean-publish build projects/libA projects/libB projects/libC

# Publish multiple projects
lb-clean-publish publish projects/libA projects/libB

# Preview a specific project
lb-clean-publish dry-run projects/libA

This works with any project structure (monorepos, Angular libraries, etc.) without requiring workspace configuration.

License

MIT

Keywords

publish

FAQs

Package last updated on 13 Feb 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts