nvm maintainer here: the only thing that's done over HTTP is the initial redirect on http://nvm.sh, which will soon be HTTPS. This URL is only used if you type it in (because it's easy to remember).

Everything else is done over Github's super-secure HTTPS - so there's really nothing to be paranoid about.