Why do something that `npm publish` already does for us? If we're concerned about files we don't want being added to the tarball, that's what a `.npmignore` is for.