Yes, npm will publish any package.json without `private: true` set, and will publish all files in the current directory by default (anything not listed in .giti

Yes, npm will publish any package.json without `private: true` set, and will publish all files in the current directory by default (anything not listed in .gitignore or .npmignore). There is a great CLI tool called "irish-pub" I use, it shows a publish dry-run to avoid these simple mistakes.