From 0c8315e34107c130eb571cdcfe606b8cec8235f5 Mon Sep 17 00:00:00 2001
From: Sridhar G K <gksridhar09@gmail.com>
Date: Thu, 22 Oct 2026 20:39:51 +0530
Subject: [PATCH 1/2] fix(security): exclude credential and dev-only files from
 npm package via .npmignore

Signed-off-by: Sridhar G K <gksridhar09@gmail.com>
---
 .npmignore   | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 package.json |  6 +++++
 2 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/.npmignore b/.npmignore
index c29f5d19..1ab6ff7c 100755
--- a/.npmignore
+++ b/.npmignore
@@ -1,11 +1,71 @@
+# Test, coverage and CI
 test
 coverage
 .travis.yml.deprecated
 scripts/
+
+# Linter / formatter config (dev-only)
 tslint.json
 .eslintrc.js
 .eslintcache
 .eslintignore
-.github
+eslint.config.js
+.prettierrc.js
+
+# TypeScript source (consumers use compiled dist/)
 *.ts
 !*.d.ts
+
+# Project / CI config (dev-only)
+.github
+.gitattributes
+.nvmrc
+.releaserc
+.whitesource
+renovate.json
+tsconfig.json
+CODE_OF_CONDUCT.md
+CONTRIBUTING.md
+
+# credential/env files must never ship in the npm package
+*.env
+*.env.enc
+*.env.properties
+*.properties
+secrets.tar
+.secrets.baseline
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime / test artefacts
+.nyc_output
+*.tgz
+.yarn-integrity
+pids
+*.pid
+*.pid.lock
+*.seed
+.node_repl_history
+build/Release
+lib-cov
+typings/
+.npm
+
+# Dependency directories
+node_modules/
+
+# MacOS
+.DS_Store
+
+# IDE files
+.idea
+.vscode/
+.project
+.classpath
+
+# SDK generator
+.openapi-generator*
diff --git a/package.json b/package.json
index 4e7e0a90..bde01c54 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,12 @@
     "ibm"
   ],
   "author": "IBM Corp.",
+  "files": [
+    "dist/",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "eslint:fix": "eslint . --fix",
     "eslint:check": "eslint . --cache",

From 1f8b946e2f48b8bc160631182730b47e930c476b Mon Sep 17 00:00:00 2001
From: Sridhar G K <gksridhar09@gmail.com>
Date: Thu, 22 Oct 2026 21:02:24 +0530
Subject: [PATCH 2/2] fix(package): remove files which is unnecessary for npx
 semantic release

Signed-off-by: Sridhar G K <gksridhar09@gmail.com>
---
 package.json | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/package.json b/package.json
index bde01c54..4e7e0a90 100644
--- a/package.json
+++ b/package.json
@@ -10,12 +10,6 @@
     "ibm"
   ],
   "author": "IBM Corp.",
-  "files": [
-    "dist/",
-    "LICENSE",
-    "README.md",
-    "CHANGELOG.md"
-  ],
   "scripts": {
     "eslint:fix": "eslint . --fix",
     "eslint:check": "eslint . --cache",