npm publish
actually zips up your module directory and sends the zip to be stored on the npm servers.
if you have passwords and large files in your working directory they may be included in the zip unless you add them to a .npmignore (if an .npmignore is not present it will check .gitignore instead)
on github:
- merge PR to master
locally:
- switch to master branch important
- pull origin master locally important