Make npm package private by default