read package.json rather than require