added package.json.bak to public/ftp

otherwise finding the vulnerable dependency relies on wild guesses or going to github and check the file there (which is somewhat like cheating)