Twist cli report: .key and .pem files are being exposed

What's going wrong?

Twist cli detected a vulnerability in the CI pipeline where pm2 package is exposing some private keys.

Supporting information

/usr/local/lib/node_modules/pm2/node_modules/agent-base/test/ssl-cert-snakeoil.key, /usr/local/lib/node_modules/pm2/node_modules/get-uri/test/server.key, /usr/local/lib/node_modules/pm2/node_modules/http-proxy-agent/test/ssl-cert-snakeoil.key, /usr/local/lib/node_modules/pm2/node_modules/nssocket/test/fixtures/ryans-key.pem, /usr/local/lib/node_modules/pm2/node_modules/pac-proxy-agent/test/ssl-cert-snakeoil.key, /usr/local/lib/node_modules/pm2/node_modules/proxy-agent/test/ssl-cert-snakeoil.key, /usr/local/lib/node_modules/pm2/node_modules/socks-proxy-agent/node_modules/agent-base/test/ssl-cert-snakeoil.key, /usr/local/lib/node_modules/pm2/node_modules/socks-proxy-agent/test/ssl-cert-snakeoil.key

Start by inspecting the listed pm2 dependency paths, especially the test and fixtures directories containing the .key and .pem files, and determine how they are included in the CI or published package. Reproduce the Twist CLI finding if possible; done means the reported private-key exposure is removed or otherwise no longer detected.