various improvements

- default to empty whitelist
- add package.json
- add test for node globals vein inaccessible