use `find-root` for reliable package.json lookup

Fixes #1