package.json: prevent accidential publish by setting 'private': true