Thanks to @gilles-heinesch for the lead. The API of discord.js
got drastically changed over time, so here is an updated version:
const { Client, Permissions } = require('discord.js');
/** @param {string|number} serverId - a "snowflake" ID you can see in address bar */
async function createPrivateChannel(serverId, channelName) {
const guild = await client.guilds.fetch(serverId);
const everyoneRole = guild.roles.everyone;
const channel = await guild.channels.create(channelName, 'text');
await channel.overwritePermissions([
{type: 'member', id: message.author.id, allow: [Permissions.FLAGS.VIEW_CHANNEL]},
{type: 'member', id: client.user.id, allow: [Permissions.FLAGS.VIEW_CHANNEL]},
{type: 'role', id: everyoneRole.id, deny: [Permissions.FLAGS.VIEW_CHANNEL]},
]);
}