validate package.json