Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to "grep" as a bare argument, without "-e", in "nvm_ls_remote_index_tab", "nvm_remote_version", and "nvm_ls_cached". A ".nvmrc" whose first line starts with "-", such as "-Rohenpm_[A-Za-z0-9]*", is parsed as grep options; with GNU grep, "-R" searches the current directory recursively (following symlinks) instead of the version list. On a bare "nvm install", nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to "../../.npmrc" can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters "0-9A-Za-z._+-". Version 0.41.0 passes every version pattern to grep with "-e".