[Cherry-pick from 1.2.x] Fix wrong picking of the npm package.json

[ligangty]

Sometimes the npm tarball will contain more than one package.json, we
should always use the root package.json as the first product metadata.

[coveralls]

Pull Request Test Coverage Report for Build 8632453372

Details

• 39 of 39 (100.0%) changed or added relevant lines in 2 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.2%) to 66.146%

---

Totals
Change from base Build 8631852999:	0.2%
Covered Lines:	1821
Relevant Lines:	2753

---

💛 - Coveralls