read package.json instead of require to avoid cache