Is package.json vulerable?