nvm maintainer here: the only thing that&#x27;s done over HTTP is the initial redirect on <a href="http:&#x2F;&#x2F;nvm.sh" rel="nofollow">http:&#x2F;&#x2F;nvm.sh</a>, which will soon be HTTPS. This URL is only used if you type it in (because it&#x27;s easy to remember).<p>Everything else is done over Github&#x27;s super-secure HTTPS - so there&#x27;s really nothing to be paranoid about.