Your assumptions are mostly correct but you can make things a tad simpler...
You are de-facto creating a new package, so you should update your package.json such that it is clear it is something different and a new package. Your users will be thankful for this.
The MIT license requirements are quite minimal: just keep a copy of the copyright and license with the code at all times. For this you simply can carry the original LICENSE file ... And/or add such notice or a simplified SPDX-License-identifier and copyright to every file: that's likely overkill but this is something I personally like as it is an affirmative statement of origin that is inside the files as opposed to external. Note that using SPDX license ids is already part of the NPM package.json spec.
Avoid fancy copyright statements if possible. The common approach is just to slap your own copyright statement on top of the previous one e.g. something like this:
Copyright (c) 2017 stkvtflw
Copyright (c) 2015 Cory House
One of the reason why you want to avoid things like your suggested new notice:
Copyright for portions of project [Original project name] are held by [original author, year] as part of project [New project name]. All other copyright for project Foo are held by [new name, year].
... is that one day I or someone will scan your code for license and copyrights with my tool ... and this new copyright form of yours would unlikely be detected correctly and would require me to update my code to add yet another copyright statement style variation in my copyright parser grammar.
Any other copyright detection tool will likely have the same issue ;)
So be gentle and make it easy for others to mechanically discover your licensing and copyright information by keeping things simple and as "standard" as possible. IMHO if it is detected by scancode then this is quite likely standard and common enough ;)
