package.json stripped from md5