The test took the last `nvm ls-remote` line and trimmed its whitespace, which kept the markers `ls-remote` adds once that version is installed (a trailing ` *`) or current (a leading `->`), so it passed eg `iojs-v1.8.4 *` to `nvm run` as the version.
That only resolved because `nvm_ls` interpreted ` *` as a regex; ask `nvm_remote_version` for the version instead.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HZAFTTUK; the scanner correctly classified it as not a vulnerability.