default package.json (without deps)