package.json - password-hash