How to ignore npm modules with scoped dependencies?

I have a repository with a package.json with dependencies that are scoped. I also have a an .npmignore file intended to only whitelist dist/. The problem is all scoped dependencies are still being pulled in when installed in another repository.

package.json:

   {
      "name": "@private/a",
      "version": "1.0.0",
      "description": "",
      "main": "dist/index.js",
      "scripts": {
        "test": "echo \"Error: no test specified\" && exit 1"
      },
      "repository": {
        "type": "git",
        "url": "git+ssh://git@bitbucket.org/private/a.git"
      },
      "author": "",
      "license": "ISC",
      "homepage": "https://bitbucket.org/private/a#readme",
      "devDependencies": {
        "gulp": "^3.9.1",
        "gulp-angular-embed-templates": "^2.3.0",
        "gulp-concat": "^2.6.1",
        "gulp-jshint": "^2.0.4",
        "gulp-rename": "^1.2.2",
        "gulp-sass": "^3.0.0",
        "gulp-uglify": "^2.0.0",
        "jshint": "^2.9.4"
      },
      "dependencies": {
        "@private/b": "^1.0.0",
        "@private/c": "^1.0.0"
      }
    }

.npmignore

**
!dist/**

Despite these two files when I run npm install @private/a --save within another module it is installing the modules along with all it's scoped dependencies:

/node_modules/@private/a/dist/index.js
/node_modules/@private/a/node_modules/@private/b
/node_modules/@private/a/node_modules/@private/c

How can I prevent this? It does not pull in any non scoped dependencies such as angular but it does also include public repositories such as @uirouter.

via jrquick