add ghost permissions to package.json