use `find-root` for reliable package.json lookup

[`find-root`](https://www.npmjs.com/package/find-root) reliably finds the closest `package.json`.

This PR fixes #1.