a plugin's package.json can be invalid too