Use private: true to prevent publishing to npm registry