[BUG] npm pack adds files not specified in package.json

[mohd-akram]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm pack adds files not specified in the files field in package.json. This seems to happen due to misinterpreting .gitignore files in subdirectories (they should only exclude, never include files). This did not happen in previous versions of npm.

npm notice === Tarball Contents === 
npm notice 59B package.json  
npm notice 3B  src/.gitignore
npm notice 0B  src/ignore.js 
npm notice 0B  src/index.js  

Expected Behavior

npm notice === Tarball Contents === 
npm notice 59B package.json
npm notice 0B  src/index.js

Steps To Reproduce

mkdir npm-test && cd npm-test && mkdir src
echo '{ "name": "x", "version": "1", "files": ["src/index.js"] }' > package.json
echo '!*' > src/.gitignore
touch src/index.js src/ignore.js
npm pack

Environment

• npm: 10.2.4
• Node.js: v20.9.0
• OS Name: macOS
• System Model Name: MacBook Pro
• npm config:

; "user" config from /Users/user/.npmrc

//registry.npmjs.org/:_authToken = (protected) 
prefix = "/Users/user/.local" 
python = "python3" 

; node bin location = /opt/local/bin/node
; node version = v20.9.0
; npm local prefix = /private/tmp/npm-test
; npm version = 10.2.4
; cwd = /private/tmp/npm-test
; HOME = /Users/user
; Run `npm config ls -l` to show all defaults.