I've read through the 19.1 release notes and the documentation associated with the Component Plugins, which I'm sure everyone is excited about being able to create custom components. A few quick questions I have that I don't believe were mentioned in the documentation:
npm
Discussion posts and replies are publicly visible
1. Yes, they can be withheld. When submitting your plug-in you can specify that it be private. It will go through the standard review process but it will NOT be publicly listed on the AppMarket or to Administration Console --> Plug-ins on Cloud environments. Once approved, if you are looking to use the plug-in on a cloud environment you'll need to open a support ticket to have it deployed.