add "permissions" in package.json