private repos and overwriting .package.json