npm pack doesn't follow .npmignore

Question

my package tree:

LICENSE
README.md
main.js
package.json
- node_modules
   - m
      foo.wasm
      package.json

I want to npm pack to include the node_modules/m, the private module not be published to npmjs. Here is my .npmignore:

**/*

!main.js
!node_modules/m/package.json
!node_modules/m/foo.wasm

My .gitignore:

node_modules

But npm pack doesn't follow it and only pack the first four files.

npm notice === Tarball Contents ===
npm notice 35.1kB LICENSE
npm notice 104B   README.md
npm notice 12.6kB main.js
npm notice 1.2kB  package.json

From https://docs.npmjs.com/cli/v7/using-npm/developers#keeping-files-out-of-your-package, npm will use .npmignore first. My question is why npm pack does not follow it? Is there an error in my usage?

Thanks.

Answer 1

In your npmjs link it is said that

Additionally, everything in node_modules is ignored, except for bundled dependencies. npm automatically handles this for you, so don't bother adding node_modules to .npmignore.

So if you add your "m module" as bundleddependencies in your package.json file, npm pack will add into the pack.

But, naturally, it will also add dependencies of your "m module" into the pack file. Hard bounded dependencies require all hard included dependencies.