yeah, ``$package`` here is not the root one but the whitelisted dependency