[__derek__]

This seems like a situation where npm can't win. If it only allows npm-specific information in the package.json, then people will complain about how they have to have 10 different configuration files in the root of a JavaScript project. If they allow arbitrary configuration, it's blamed for being too permissive.

[skybrian]

There are other possibilities. They could have a registry for allowed keys, or allow them but only under "extensions".