The chroot checks source `nvm.sh` from `/bin/sh` without `NVM_DIR`,
so nvm has to guess it:
today from `dirname "$0"`,
which is `/bin` here.
That guess is incidental to what the test checks
(architecture detection),
so set `NVM_DIR` explicitly to the directory the chroot's `nvm.sh` lives in,
as the README instructs
Discovered by Anthropic's OSS Scanner, as ANT-2026-8RIT0MGO; the scanner reported it as a vulnerability, but it is not one.
Jordan Harband
c07e8722a1