Use a whitelist for npm content instead of .npmignore.