Update package.json

xml2js has a dependency on xmlbuilder and xmlbuilder > 0.4.3 has a dependency on lo-dash which is broken in the newer version. So locking it to the working version.