Previously, type stripping applied broadly in node_modules, risking unintended removal of types from public packages and allowing private package.json files to be smuggled inside non-private packages.

The earlier implementation lacked granularity, applying type stripping without distinguishing private from public packages, and did not enforce strict checks on package privacy metadata within nested node_modules directories, as handled in internal modules like package_json_reader.js and node_modules.cc.

Introduced the --experimental-strip-private-modules CLI flag that triggers type stripping exclusively for packages marked as private by their package.json, with enhanced logic in package_json_reader.js and node_modules.cc to correctly identify private packages and prevent privacy smuggling. The change also updated TypeScript handling in internal/modules/typescript.js and added comprehensive tests in test/es-module/test-typescript.mjs to validate this behavior.

When modifying behavior that depends on package metadata in nested dependencies, explicitly enforce privacy boundaries and implement targeted feature flags to avoid broad unintended side effects.