password hash package.json