package.json with no deps, closes #421