The nvm install script clones the nvm repository into ~/.nvm and tries to add source lines to your shell profile file, such as ~/.bashrc, ~/.bash_profile, ~/.zshrc or ~/.profile. So it changes a folder in your home directory and a startup file that runs in every new terminal.
What the project documents
nvm's README tells you to run its install script to install or update, either by downloading and running it manually or by using a curl or wget command that pipes the script into bash. The README pins a version number in the URL. It explains that running the command downloads a script and runs it, that the script clones the repository to ~/.nvm, and that it attempts to add the source lines to the correct profile file. If it picks the wrong file, you can set a PROFILE variable to the path you want and rerun it.
Why the profile file matters
A shell profile runs each time you open a terminal. Anything added there executes with your privileges, early, and every time. That makes it a good place for a tool to hook in, and also a place worth checking after any installer touches it. Our post on whether curl piped to a shell is safe covers the general risk.
A more careful way to run it
- Download the script to a file instead of piping it.
- Read it, or at least skim for what it writes and where.
- Check the version in the URL matches the release you intended, and compare with the project's releases page.
- Run it from the file.
- Open the profile file it edited and read the added lines.
- Open a new terminal and confirm nvm works.
curl -o install-nvm.sh https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.8/install.sh
less install-nvm.sh
bash install-nvm.sh
The version in that URL is the one shown in the README when this post was reviewed. Check the README for the current number before you copy it.
What you gain
npm's own advice on permission errors points to a node version manager, because it keeps Node and global packages in your home directory rather than a system folder. We cover that in using sudo with npm install -g. So the installer is worth running, but carefully.
Updating nvm itself
The README says the same install script is used to update nvm. That means every update is another run of a downloaded script, so apply the same care each time: fetch to a file, check the version, read the profile changes. It is easy to be careful once and careless on the fifth update.
What to do afterwards
- Record the nvm version and install date in your laptop notes.
- Update through the same documented path, not by copying an old command.
- Remove versions of Node you no longer use.
- Treat ~/.nvm as software that runs as you, and include it in your regular tool review.
Quick check
Does the nvm script need sudo?
The README describes cloning into ~/.nvm in your home directory and editing a profile file, so root is not part of that description.
What if it edits the wrong profile file?
Set the PROFILE variable to the right file path and rerun the install script, as the README describes.
Sources
Last reviewed: 19 October 2026.
