Fix package.json bin path.
A note about security.