[npm] set private to avoid publishing to registry