Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when "NVM_AUTH_HEADER" is set, "nvm_download" passes the credential to curl or wget as a "--header "Authorization: ..."" command-line argument. Process arguments are visible to every local user (on Linux via "ps" or "/proc//cmdline" unless "/proc" is mounted with "hidepid="; on macOS via "ps"), so another unprivileged account on the same machine can read the token while nvm is downloading during "nvm ls-remote", "nvm install", and similar commands, and gain whatever access it grants on the private mirror. Only users who set "NVM_AUTH_HEADER" on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.