Should be able to target the package.json location based on the process.env.npm_lifecycle_event == 'postpack', therefore not requiring any new APIs. However, research needs to be done in order to determine if changing the package.json in the tgz and during this npm_lifecycle_event break anything.