Change when package dependency to not use https

Same as https://github.com/busterjs/buster/pull/321