so that we don't publish all the repo's files to npm, which at the moment includes even git-ignored files like .venv

🤦
More info: https://docs.npmjs.com/cli/v6/configuring-npm/package-json#files
I think we would only need:

but we should double-check that we don't rely on npm for other files.
Once the details are worked out, if might be good to submit a PR to https://github.com/plotly/dash-component-boilerplate/ as well.