<<EOF instead of
This is what POSIX says about here-documents [emphasis mine]:
If any part of
word is quoted, the delimiter shall be formed by performing quote removal on
word, and the here-document lines shall not be expanded. Otherwise, the delimiter shall be the
If no part of
word is quoted, all lines of the here-document shall be expanded for parameter expansion, command substitution, and arithmetic expansion. […]
In you case
'EOF' (quoted!), so
$package inside the here-document is not expanded. Drop these quotes and you will get the desired result.
cat > out.json <<EOF
Note this has nothing to do with quotes that surround the variable inside the here-document.