Do I have to keep a

package.json

for each pulumi project I have?

no, an option is to have a single package.json at the root of the repo that's used by all your pulumi projects. but you'd have to check multiple projects if you upgrade an npm package