The presence of the yarn.lock file also makes several Container Scanning tools go off.

Yes. That is one more reason

I also noticed README.md.bak, but I don’t have yarn.lock. Maybe because I don’t use yarn. 🤷‍♂️

I have found the reason why README.md.bak is there: in package.json (L27-30), there are the following scripts:

"update-readme": "sed -i.bak 's/\\/master\\.svg/\\/v'$(npm --silent run get-version)'.svg/g' README.md",
"restore-readme": "mv README.md.bak README.md",
"prepublish": "in-publish && npm run update-readme || not-in-publish",
"postpublish": "npm run restore-readme"

Basically, when someone runs npm run publish, it backs up README.md (actually, there is no such file, as the file is name Readme.md; maybe the maintainer runs this on MS Windows) and updates the SVG path. After publishing, for some reason it restores the original (backed up) README.md.

So, all we need to do to fix this issue is:

1. either rename Readme.md to README.md or update update-readme and restore-readme scripts to use Readme.md and Readme.md.bak filenames;
2. add files array to package.json:

{
  ...
  files: [
    "index.d.ts",
    "lib",
    "Licence",
    "package.json",
    "Readme.md"  // Or `README.md`
  ]
  ...
}

If @niftylettuce (or any other maintainer) is okay with this, I can create a PR. 😉