make package.json more robust