npm publish silently ignores .gitignore when a .npmignore file is present

When an npm package is audited using 'npm pack --dry-run', developers may discover that sensitive files excluded in .gitignore are actually being published to the registry. This happens because npm follows a strict priority order — the 'files' array in package.json, then .npmignore, then .gitignore — stopping at the first match it finds. Adding even a minimal .npmignore file completely overrides all .gitignore rules, without any warning from npm. npm's built-in always-excluded list is narrow and does not cover common sensitive files such as .env files, private keys, or internal notes. Experts recommend using the 'files' whitelist in package.json instead of .npmignore, and verifying tarball contents in CI to prevent accidental data exposure.