removed unsafe perm flag from package.json