Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's ".npmrc" sets "prefix", "nvm use" tells the user to run "nvm use --delete-prefix", which runs "npm config delete prefix" and "npm config delete globalconfig" in the current directory without naming a config file. npm loads the project ".npmrc" before deciding which file to edit, so that file chooses the target: "userconfig=~/.bashrc" makes npm rewrite "~/.bashrc" as ini (corrupting it), and "location=global" with "globalconfig=" leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project ".npmrc" select which config file "--delete-prefix" edits.