I just submitted an issue:
In summary, I published with npm publish --access=restricted, but the package is still public. See the above issue for more details.
npm publish --access=restricted