diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 6a0dc735d9..7043240a84 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -23,6 +23,7 @@ jobs:
       - run: npm test
         env:
           FORCE_COLOR: 3
+      - run: node scripts/clean-package-json.mjs
       - run: echo "//wombat-dressing-room.appspot.com/:_authToken=$AUTH_TOKEN" >> .npmrc
         env:
           AUTH_TOKEN: ${{ secrets.AUTH_TOKEN }}
diff --git a/scripts/clean-package-json.mjs b/scripts/clean-package-json.mjs
new file mode 100644
index 0000000000..0ae7fccd49
--- /dev/null
+++ b/scripts/clean-package-json.mjs
@@ -0,0 +1,49 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { createRequire } from 'node:module'
+
+const __dirname = path.dirname(new URL(import.meta.url).pathname)
+const pkgJsonFile = path.join(__dirname, '../package.json')
+
+const whitelist = new Set([
+  'name',
+  'version',
+  'description',
+  'type',
+  'main',
+  'types',
+  'typesVersions',
+  'exports',
+  'bin',
+  'man',
+  'files',
+  'engines',
+  'optionalDependencies',
+  'publishConfig',
+  'keywords',
+  'repository',
+  'homepage',
+  'author',
+  'license',
+])
+
+const _pkgJson = createRequire(import.meta.url)('../package.json')
+const pkgJson = Object.fromEntries(
+  Object.entries(_pkgJson).filter(([k]) => whitelist.has(k))
+)
+
+fs.writeFileSync(pkgJsonFile, JSON.stringify(pkgJson, null, 2))
diff --git a/test/it/clean-package-json.test.js b/test/it/clean-package-json.test.js
new file mode 100644
index 0000000000..f018abd00f
--- /dev/null
+++ b/test/it/clean-package-json.test.js
@@ -0,0 +1,54 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import assert from 'node:assert'
+import { tempdir, $, path, fs } from '../../build/index.js'
+import { describe, before, after, it } from 'node:test'
+
+const __dirname = path.dirname(new URL(import.meta.url).pathname)
+const root = path.resolve(__dirname, '../../')
+
+describe('package.json artifact', () => {
+  let tmp
+  let t$
+
+  before(async () => {
+    tmp = tempdir()
+    t$ = $({ cwd: tmp, quiet: true })
+
+    await fs.copy(
+      path.resolve(root, 'package.json'),
+      path.resolve(tmp, 'package.json')
+    )
+    await fs.copy(
+      path.resolve(root, 'scripts/clean-package-json.mjs'),
+      path.resolve(tmp, 'scripts/clean-package-json.mjs')
+    )
+  })
+
+  after(() => fs.remove(tmp))
+
+  it('handle exist properties required for publishing', async () => {
+    await t$`node scripts/clean-package-json.mjs`
+    // to throw if manifest is not correct
+    const pkgJson = JSON.parse(
+      fs.readFileSync(path.resolve(tmp, 'package.json'))
+    )
+
+    assert.equal(pkgJson.name, 'zx')
+    assert.equal(pkgJson.description, 'A tool for writing better scripts')
+    assert.equal(pkgJson.prettier, undefined)
+    assert.equal(pkgJson.scripts, undefined)
+  })
+})