How to keep package.json under control