marked npm package file as private to prevent accidental publishing