Comment # 2 on bug 1231670 from Daniel Garcia

python-nbdime is not affected. markdown-to-jsx is mentioned in the source
tar.gz  but not installed in the vendored node_modules.obscpio.

The package-lock.json present in the tar.gz is replaced by the custom provided
using the local-npm-registry tool.