diff --git a/docs/npm_package.md b/docs/npm_package.md
index ff101b579..7f536f9cd 100644
--- a/docs/npm_package.md
+++ b/docs/npm_package.md
@@ -107,7 +107,7 @@ To stamp the current git tag as the "version" in the package.json file, see
 | <a id="npm_package-include_transitive_sources"></a>include_transitive_sources |  When True, <code>transitive_sources</code> from <code>JsInfo</code> providers in data targets are included in the list of available files to copy.   |  <code>True</code> |
 | <a id="npm_package-include_declarations"></a>include_declarations |  When True, <code>declarations</code> from <code>JsInfo</code> providers in data targets are included in the list of available files to copy.   |  <code>True</code> |
 | <a id="npm_package-include_transitive_declarations"></a>include_transitive_declarations |  When True, <code>transitive_declarations</code> from <code>JsInfo</code> providers in data targets are included in the list of available files to copy.   |  <code>True</code> |
-| <a id="npm_package-include_runfiles"></a>include_runfiles |  When True, default runfiles from <code>srcs</code> targets are included in the list of available files to copy.<br><br>This may be needed in a few cases:<br><br>- to work-around issues with rules that don't provide everything needed in sources, transitive_sources, declarations & transitive_declarations - to depend on the runfiles targets that don't use JsInfo<br><br>NB: The default value will be flipped to False in the next major release as runfiles are not needed in the general case and adding them to the list of files available to copy can add noticeable overhead to the analysis phase in a large repository with many npm_package targets.   |  <code>True</code> |
+| <a id="npm_package-include_runfiles"></a>include_runfiles |  When True, default runfiles from <code>srcs</code> targets are included in the list of available files to copy.<br><br>This may be needed in a few cases:<br><br>- to work-around issues with rules that don't provide everything needed in sources, transitive_sources, declarations & transitive_declarations - to depend on the runfiles targets that don't use JsInfo<br><br>NB: The default value will be flipped to False in the next major release as runfiles are not needed in the general case and adding them to the list of files available to copy can add noticeable overhead to the analysis phase in a large repository with many npm_package targets.   |  <code>False</code> |
 | <a id="npm_package-hardlink"></a>hardlink |  Controls when to use hardlinks to files instead of making copies.<br><br>Creating hardlinks is much faster than making copies of files with the caveat that hardlinks share file permissions with their source.<br><br>Since Bazel removes write permissions on files in the output tree after an action completes, hardlinks to source files are not recommended since write permissions will be inadvertently removed from sources files.<br><br>- <code>auto</code>: hardlinks are used for generated files already in the output tree - <code>off</code>: all files are copied - <code>on</code>: hardlinks are used for all files (not recommended)   |  <code>"auto"</code> |
 | <a id="npm_package-verbose"></a>verbose |  If true, prints out verbose logs to stdout   |  <code>False</code> |
 | <a id="npm_package-kwargs"></a>kwargs |  Additional attributes such as <code>tags</code> and <code>visibility</code>   |  none |
diff --git a/npm/private/npm_package.bzl b/npm/private/npm_package.bzl
index a2cd4d967..a65a94674 100644
--- a/npm/private/npm_package.bzl
+++ b/npm/private/npm_package.bzl
@@ -171,8 +171,7 @@ def npm_package(
         include_transitive_sources = True,
         include_declarations = True,
         include_transitive_declarations = True,
-        # TODO(2.0): flip include_runfiles default to False
-        include_runfiles = True,
+        include_runfiles = False,
         hardlink = "auto",
         verbose = False,
         **kwargs):