Our own repo said anyone was welcome to reuse it
package.json still held whatever npm init guessed on day one. license: ISC is not a placeholder — it is an affirmative grant, so on a private repo for a site we run it was quietly telling anyone reading that the code was theirs to take. main pointed at a browser script nothing ever requires, and repository named a fork we don't deploy from.
Set private: true, which is the field that actually prevents an accidental publish, and made the rest of it say what is true. Nobody had read any of it in a year, which is the point: the boilerplate makes claims on your behalf whether or not you meant them.