• VSCode Version: Code - Insiders 1.20.0-insider (5c8c834, 2018-01-11T06:08:01.655Z)
• OS Version: Darwin x64 17.3.0
• Extensions: none

Steps to Reproduce:

1. Use a network monitor tool (e.g. Wireshark/Little Snitch)
2. Open a package.json e.g.

   {
       "dependencies": {
           "chalk": ""
       }
   }

3. Place the text cursor next to "chalk": " and then auto-complete

Does this issue occur when all extensions are disabled?: Yes

Similar to #40736, it will be great to move away from plain-text HTTP to HTTPS to resist tampering.