Set private to true in root level package.json

This will make sure npm does not publish this package.json and makes it clear to developers that this is not the package that you install via npm.