[kall]

npm publish already prevents you from publishing a package that has the private flag. They must not have had it set.