get nearest package.json starting at project root, not pwd