permissions of package json