That is indeed the recommended and best way. However, require.resolve only works if the package defines a main script. I've noticed that some don't - it caught me out with uibuilder as that has to do extensive checking for installed packages. I even tried to raise an issue for it which got knocked back since the devs say that this is the way it works.
This is an area that is hard to get right and a real weakness of the npm/node.js packaging process in my opinion.
Bart, you might check out the uibutils.js and the tiutils.js files in uibuilder as they have a number of functions for finding the paths to packages. Of course, if it is only that one package and it defines a main entry point in package.json then you are fine.
You certainly cannot rely on a package being in a peer folder of your own package. It could be in the global location or at the wrong end of a link or, with @ groupings, it could be in a sub-folder of one of those locations.
