How to publish private npm package

I just submitted an issue:

In summary, I published with npm publish --access=restricted, but the package is still public. See the above issue for more details.