Update package.json

don't trust anyone