use findup instead of process.cwd to locate package.json
use globule to support multiple patterns