make it private

package.json should be private,

see [package.json](https://npmjs.org/doc/json.html)