Adel Assakaf (https://github.com/assakafpix)

nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write