Will your npm package leak source maps?

Paste your package.json and .npmignore to check before you build. Catches the configuration mistakes that lead to source map leaks, in seconds.

How SourceMapCheck works

1. 1

   Paste your configuration files

   Paste your package.json (required), and optionally your .npmignore and tsconfig.json. The tool checks whatever you provide.

2. 2

   Static analysis runs in your browser

   SourceMapCheck parses each file and checks for known risk patterns: missing files field, overly broad globs, absent .map exclusions, and sourceMap flags in TypeScript configs.

3. 3

   Each risk is classified and explained

   Results are grouped by severity (pass, warning, fail) with a plain-English explanation of what is wrong and why it matters.

4. 4

   Copy the suggested fix directly

   Every flagged issue includes a copy-ready configuration snippet: a corrected files array, a .npmignore line, or a tsconfig.build.json example.

5. 5

   Get a CI automation snippet

   After the check, copy a ready-to-paste GitHub Actions step that runs npm pack --dry-run and fails the build if any .map files are detected.

What each result means

SourceMapCheck classifies each finding by severity so you can prioritise the most critical fixes first.

// package.json with NO files field
{
  "name": "my-lib",
  "main": "dist/index.js"
}
// Everything in the project directory ships, including dist/*.map

// tsconfig.json with sourceMap enabled
{
  "compilerOptions": {
    "sourceMap": true,    // Risk: is this also your production config?
    "outDir": "./dist"
  }
}

// package.json with explicit allowlist
{
  "name": "my-lib",
  "files": ["dist/**/*.js", "dist/**/*.d.ts"],
  "main": "dist/index.js"
}
// Only .js and .d.ts files ship — .map files are excluded by default

Configuration reference

The three configuration points that control whether source maps end up in your published package.

{
  "name": "your-package",
  "files": [
    "dist/**/*.js",
    "dist/**/*.d.ts",
    "README.md",
    "LICENSE"
  ]
}

# Exclude source maps
*.map
**/*.map

# Exclude source files
src/
tsconfig*.json

{
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "sourceMap": false,
    "declarationMap": false
  }
}

When to use SourceMapCheck