made npm repository private via package.json