cant be a private package if publishing to npm