Jordan Harband (https://github.com/ljharb)

nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

nvm install --offline installs a cached tarball that previously failed checksum verification

nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

nvm prints the contents of any readable file through a symlinked .nvmrc

nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory