fixed warning about which module

When I do `npm i` I get the following warning:
```shell
npm WARN package.json Dependency 'which' exists in both dependencies and devDependencies, using 'which@^1.0.5' from dependencies
```
This PR fixes that. Assuming that `which` is also used in production.