package.json conflict
key lookup when not in root context with undefined/null value fails,
fixes #397, fixes #409