add .publishConfig to prevent accidental publishing to public npm