package.json lookup logic