static rebaseLockfile(pathToPackageRoot, lockfile) {
    if (lockfile.version) {
      lockfile.version = NPM._rebaseFileReferences(pathToPackageRoot, lockfile.version);
    }

    if (lockfile.dependencies) {
      _.forIn(lockfile.dependencies, lockedDependency => {
        NPM.rebaseLockfile(pathToPackageRoot, lockedDependency);
      });
    }

    return lockfile;
  }
We should not be modifying 'package-lock.json'
because this file should be treated as internal to npm.

Rebase package-lock is a temporary workaround and must be
removed as soon as https://github.com/npm/npm/issues/19183 gets fixed.