fix: always ignore .npmrc files at every level

lib/index.js

@@ -38,12 +38,11 @@ const defaults = [
 ]
 
 const strictDefaults = [
-  // these are forcibly included at all levels
+  // these are forcibly excluded
   '!/readme{,.*[^~$]}',
   '!/copying{,.*[^~$]}',
   '!/license{,.*[^~$]}',
   '!/licence{,.*[^~$]}',
-  // these are forcibly excluded
   '/.git',
 ]
 
@@ -286,6 +285,7 @@ class PackWalker extends IgnoreWalker {
       ...strictDefaults,
       '!/package.json',
       '/.git',
+      '.npmrc',
       '/node_modules',
       '/package-lock.json',
       '/yarn.lock',

test/ignore-file-included-by-globstar.js

@@ -4,9 +4,45 @@ const Arborist = require('@npmcli/arborist')
 const t = require('tap')
 const packlist = require('../')
 
+t.test('exclude certain files always', async t => {
+  const path = t.testdir({
+    '.npmrc': 'secrets=true',
+    '.git': {
+      HEAD: 'empty',
+    },
+    node_modules: {
+      foo: {
+        'index.js': '',
+      },
+    },
+    subdir: {
+      'other.js': '',
+      '.npmrc': 'sneaky=true',
+    },
+    'index.js': '',
+    'glorp.txt': '',
+    'package.json': JSON.stringify({
+      name: '@npmcli/globstar-test',
+      version: '1.0.0',
+      files: ['*'],
+    }),
+    'package-lock.json': '{}',
+    'yarn.lock': '{}',
+    'pnpm-lock.yaml': '{}',
+  })
+  const arborist = new Arborist({ path })
+  const tree = await arborist.loadActual()
+  const files = await packlist(tree)
+  t.same(files, [
+    'index.js',
+    'subdir/other.js',
+    'package.json',
+    'glorp.txt',
+  ])
+})
+
 t.test('include a globstar, then exclude one of them', async (t) => {
   const path = t.testdir({
-    'foo.js': '',
     'bar.js': '',
     bar: {
       'bar.js': '',