Defaulting package.json "private": true

for an extra measure of paranoia, mostly.
See: https://npmjs.org/doc/json.html#private