This seems like a situation where npm can't win. If it only allows npm-specific information in the package.json, then people will complain about how they have to have 10 different configuration files in the root of a JavaScript project. If they allow arbitrary configuration, it's blamed for being too permissive.