[BUG] Package tarballs are included by default

[remcohaszing]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Running npm pack includes the previous result of npm pack by default.

Expected Behavior

The result of npm pack is excluded. This probably means all .tgz files should be excluded. Users can choose to exclude it, but many don’t know about it.

Steps To Reproduce

1. Clone a repo that doesn’t use the files fields in package.json and doesn’t use .npmignore to exclude .tgz files. For example:

   git@github.com:postcss/postcss.git
   cd postcss

2. Packing produces the expected results:

   npm pack

3. Packing again includes the previously built tarball

   npm pack

Environment

• npm: v20.5.1
• Node: 9.8.1
• OS: Pop!_OS 22.04
• platform: System76 Oryx Pro

[ljharb]

This seems expected to me; most people never run npm pack at all.