Add lavamoat allow-scripts

[MichaelAJay]

Description

@lavamoat/allow-scripts is added in an effort to mitigate supply chain attack vulnerabilities. All scripts are explicitly disallowed with the exception of bcrypt.

The top-level compile script is heavily modified: the original lerna run compile command allowed packages to compile in parallel based only on Lerna's declared dependency graph. That graph did not capture several build-time relationships created by generated TS output.

Of particular note, a build-time circular dependency between bitcore-node and bitcore-client was mitigated with the split-out compile. bitcore-node cannot fully compile until bitcore-client compiles. bitcore-client cannot compile until bitcore-node has generated its production build output. LavaMoat disabled the implicit npm precompile hook that previously generated bitcore-node production build before bitcore-client compiled.

Changelog

• Add .npmrc
• Install @lavamoat/allow-scripts
• Update all package.json files with a lavamoat.allowScripts configuration
• Only bcrypt is allowed - all other scripts are not required
• Split out top-level compile script.

Testing Notes

---

Checklist

• I have read CONTRIBUTING.md and verified that this PR follows the guidelines and requirements outlined in it.

[kajoseph]

this does not run anymore when running npm ci from root. Is there a way to still allow this script to run?

[MichaelAJay]

This is intentional. We could run postinstall from the CircleCI build (I don't think we should) - but lavamoat's allow-scripts authored .npmrc specifically so we get full suppression of npm lifecycle scripts.

The reconfiguration of the CircleCI build config now addresses what postinstall was doing.

For the monorepo, we have to carry out the "Run approved dependency lifecycle scripts" from the CircleCI config between the bootstrap (which must set npm_config_ignore_scripts=true) and compile steps.

We could turn that into a script and just kick off postinstall directly from the CircleCI build (although I would press for naming it something that specifies its intentionality more) - but postinstall would need to become:
npm run bootstrap (with scripts ignored) && npm run <run approved lifecycle scripts script> && npm run compile

[kajoseph]

I'm not sure what you talking about with the CircleCI build. I'm talking about when I pull down a branch and run npm ci this PR makes it so it doesn't also run the postinstall script to bootstrap (i.e. symlink neighbor packages) and rebuild the packages. I understand that the point of lavamoat is suppress npm lifecycle scripts, but there are mechanisms for exceptions (e.g. like for bcrypt in this PR). Can we not add an exception for this particular script, too?

[kajoseph]

It seems like maybe we need another script anyway as the exceptions are never run. Don't we need to run npx allow-scripts run via lerna to really complete the npm install cycle? Something like

package.json

"scripts": {
  "setup": "npm ci && lerna exec 'npx allow-scripts run' && npm run postinstall",

npm run setup

All this begs for a new DEVELOPMENT.md or SETUP.md doc to really explain what to do

[kajoseph]

I added the following scripts to my package.json

"setup": "npm ci && npm run allow-scripts:run && npm run postinstall",
"allow-scripts:config": "lerna exec 'npx allow-scripts auto --skip-versions'",
"allow-scripts:run": "lerna exec 'npx allow-scripts run'",

Note the --skip-versions option on the config script. That'll open up the auto-script configs to be version agnostic.

Furthermore, running npm run allow-scripts:run as this branch currently sits produces some allow-script config discrepancies in BCN.

[MichaelAJay]

I made some changes.

1. There is now a setup script. I removed postinstall - its naming convention could lead to confusion, since the process we're trying to carry out specifically avoids reguarly-named lifecycle hooks.
2. I added DEVELOPMENT.md
3. As for the script changes - I think that disallowed scripts can skip versioning, but that allowed scripts should be version-controlled.

[Copilot]

Pull request overview

This PR introduces LavaMoat’s @lavamoat/allow-scripts across the monorepo to mitigate supply-chain risk by disabling dependency lifecycle scripts by default and explicitly allowlisting only required ones (notably bcrypt). It also updates CI and the root build workflow to keep compilation deterministic given previously implicit build-time dependencies.

Changes:

• Add .npmrc with ignore-scripts=true and add LavaMoat tooling (@lavamoat/allow-scripts, @lavamoat/preinstall-always-fail) at the repo root.
• Add lavamoat.allowScripts policies to multiple package package.json files (only bcrypt is allowlisted where needed; others explicitly disallowed).
• Split the root compile script into ordered sub-steps and update CircleCI to bootstrap without scripts, then run allow-scripts per package, then compile.

Reviewed changes

Copilot reviewed 20 out of 30 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Splits compile into ordered phases and adds LavaMoat tooling to devDependencies.
.npmrc	Disables install-time lifecycle scripts by default (ignore-scripts=true).
.circleci/config.yml	Updates CI flow to install deps, bootstrap without scripts, run allow-scripts, then compile.
packages/crypto-wallet-core/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/crypto-rpc/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-wallet-service/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-wallet-client/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-tss/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-p2p-doge/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p-cash/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p-cash/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-node/package.json	Adds lavamoat.allowScripts policy entries (including allowlisting bcrypt) for this package’s dependency tree.
packages/bitcore-mnemonic/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-ltc/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-ltc/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-doge/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-doge/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-cash/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-cash/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-client/package.json	Adds lavamoat.allowScripts policy entries (including allowlisting bcrypt) for this package’s dependency tree.
packages/bitcore-cli/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-build/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-build/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.

Files not reviewed (7)

• packages/bitcore-build/package-lock.json: Generated file
• packages/bitcore-lib-cash/package-lock.json: Generated file
• packages/bitcore-lib-doge/package-lock.json: Generated file
• packages/bitcore-lib-ltc/package-lock.json: Generated file
• packages/bitcore-lib/package-lock.json: Generated file
• packages/bitcore-p2p-cash/package-lock.json: Generated file
• packages/bitcore-p2p/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.