Use UNLICENSED
per the npm docs:
Finally, if you do not wish to grant others the right to use a private or unpublished package under any terms:
{
"license": "UNLICENSED"
}
This is not to be confused with the license that was confusingly called “The Unlicense”.