Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether ".nvmrc" is a symbolic link. A repository or archive that ships ".nvmrc" as a symlink to another file (for example "../../.npmrc", or "/proc/self/environ" on Linux) makes a plain "nvm use", "nvm install", "nvm which", "nvm exec", "nvm run", or "nvm-exec" read that file and print its contents in the invalid-".nvmrc" message (even with "--silent") or, for a one-line file, in the "Found ... with version <...>" message; with the README's zsh "load-nvmrc" or bash "cdnvm" hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked ".nvmrc", so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash "cdnvm" hook, which read ".nvmrc" itself, now gets the version from nvm, so users of that hook must also update their copy of it.