limit the files published to npm