There is a `private` setting in the package.json to avoid this situation.