added safety check for packages which define main with .js
moved underscore to npm