Files
nvm/test/fast/Unit tests
Jordan Harband 1f99e4c20b [Fix] nvm_download_artifact: only put an archive in the cache once its checksum has passed
`nvm install --offline` installs whatever archive sits at the cache path without checking it again, which is only safe if everything nvm writes there has been verified.
When a download failed its checksum, `nvm_download_artifact` removed only the empty `files` directory and left the rejected archive in `$NVM_DIR/.cache`, so a later `nvm install --offline` would install the very tarball the online install had just refused.
An interrupted download was also left at the final cache name.

Download to a temporary `.unverified` name instead, run the 404 and checksum checks on that file, and move it to the cache path only once the checksum has passed.
Every failure path, including a checksum mismatch or a missing expected checksum, now removes the temporary file and the version's cache directory, so `--offline` no longer finds the version at all.
The README's offline section now says that only verified downloads are cached and that `--offline` trusts the cache as-is.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-7NCT51FE.
2026-10-16 22:02:45 -07:00
..