isaacs/npmjs.org — pull request #67 by jhs (2012-06-11 12:03:49+00:00)
Title: Disallow private packages

This is only 3 lines of code changed in validate_doc_update, corresponding with the npm publish-privates pull request.

Packages are now rejected if they have "private":true set. Nobody can ever publish private packages to the central registry. OTOH, you can set the _security object, `{"npm":{ "publish-privates":true }}` (same as the npm config setting) and it will allow them.