The published package contains many files that don't need to be included, drastically increasing download/on-disk size. Additionally, including lockfiles confuses some security tools into thinking there are more dependencies than actually specified. You could use the "files": [] field in the package.json to limit which files are published.
- Other information (e.g. detailed explanation, stack traces, related issues, suggestions how to fix, links for us to have context, eg. StackOverflow, personal fork, etc.)
The published v2.4.1 had removed a bunch of the development files from the published package, but it seems the changes were never committed to the project.