making NPM private until it's finished