If you set "private": true in your package.json, then npm will refuse to publish it. This is a way to prevent accidental publication of private repositories.