Change when package dependency to not use https

Same as busterjs/buster#321