changed how packages are keyed, to try to prevent lodash spam.