Vendoring a package keeps its npm name — mark it private before it publishes over the original

Copying an upstream package into another repo carries package.json verbatim, so name still points at the published package. Any npm publish from that directory overwrites the real one, and nothing warns you — the name is right there and the command is one word. Add "private": true to the copy immediately, and only remove it once the fork has its own name decided. Leave the name itself unchanged if the fork name is still undecided: inventing a placeholder inside a copy is how the placeholder becomes the shipped answer. Same class of hazard as a copied .env.example carrying a real hostname — a copy inherits authority it was never meant to have.