Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, "nvm_download_artifact" downloads a release archive directly to its final path in "$NVM_DIR/.cache" and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later "nvm install --offline" of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its "node" and "npm" run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the "SHASUMS256.txt" beside it, if the victim runs "nvm install --offline" for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.