update package.json to make sure it doesn't sneak into npm index