package.json set to private