How to prevent users from requiring private files from NPM package?

Question

I have a package on NPM and the public API is only what can be returned from import "foo". However right now users can also do import "foo/