npm publish actually zips up your module directory and sends the zip to be stored on the npm servers.
if you have passwords and large files in your working directory they may be included in the zip unless you add them to a .npmignore (if an .npmignore is not present it will check .gitignore instead)
on github:
- merge PR to master
locally:
- switch to master branch important
- pull origin master locally important
your repo should be clean with nothing to commit
- edit package.json and increment version number eg
- add and commit change to package.json (as per above)
- git push (this shows up in the chat)
- npm publish
you're done.
now you will probably need to update all dependants package.json too with the new version number