I started getting messages every week from a carbon black scan blocking access to some npm's package.json.

IT just white listed files named package.json.