use findup instead of process.cwd to locate package.json