Add lavamoat allow-scripts

[MichaelAJay]

Description

@lavamoat/allow-scripts is added in an effort to mitigate supply chain attack vulnerabilities. All scripts are explicitly disallowed with the exception of bcrypt.

The top-level compile script is heavily modified: the original lerna run compile command allowed packages to compile in parallel based only on Lerna's declared dependency graph. That graph did not capture several build-time relationships created by generated TS output.

Of particular note, a build-time circular dependency between bitcore-node and bitcore-client was mitigated with the split-out compile. bitcore-node cannot fully compile until bitcore-client compiles. bitcore-client cannot compile until bitcore-node has generated its production build output. LavaMoat disabled the implicit npm precompile hook that previously generated bitcore-node production build before bitcore-client compiled.

Changelog

• Add .npmrc
• Install @lavamoat/allow-scripts
• Update all package.json files with a lavamoat.allowScripts configuration
• Only bcrypt is allowed - all other scripts are not required
• Split out top-level compile script.

Testing Notes

---

Checklist

• I have read CONTRIBUTING.md and verified that this PR follows the guidelines and requirements outlined in it.

[kajoseph]

this does not run anymore when running npm ci from root. Is there a way to still allow this script to run?

[MichaelAJay]

This is intentional. We could run postinstall from the CircleCI build (I don't think we should) - but lavamoat's allow-scripts authored .npmrc specifically so we get full suppression of npm lifecycle scripts.

The reconfiguration of the CircleCI build config now addresses what postinstall was doing.

For the monorepo, we have to carry out the "Run approved dependency lifecycle scripts" from the CircleCI config between the bootstrap (which must set npm_config_ignore_scripts=true) and compile steps.

We could turn that into a script and just kick off postinstall directly from the CircleCI build (although I would press for naming it something that specifies its intentionality more) - but postinstall would need to become:
npm run bootstrap (with scripts ignored) && npm run <run approved lifecycle scripts script> && npm run compile

[Copilot]

Pull request overview

This PR introduces LavaMoat’s @lavamoat/allow-scripts across the monorepo to mitigate supply-chain risk by disabling dependency lifecycle scripts by default and explicitly allowlisting only required ones (notably bcrypt). It also updates CI and the root build workflow to keep compilation deterministic given previously implicit build-time dependencies.

Changes:

• Add .npmrc with ignore-scripts=true and add LavaMoat tooling (@lavamoat/allow-scripts, @lavamoat/preinstall-always-fail) at the repo root.
• Add lavamoat.allowScripts policies to multiple package package.json files (only bcrypt is allowlisted where needed; others explicitly disallowed).
• Split the root compile script into ordered sub-steps and update CircleCI to bootstrap without scripts, then run allow-scripts per package, then compile.

Reviewed changes

Copilot reviewed 20 out of 30 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Splits compile into ordered phases and adds LavaMoat tooling to devDependencies.
.npmrc	Disables install-time lifecycle scripts by default (ignore-scripts=true).
.circleci/config.yml	Updates CI flow to install deps, bootstrap without scripts, run allow-scripts, then compile.
packages/crypto-wallet-core/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/crypto-rpc/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-wallet-service/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-wallet-client/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-tss/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-p2p-doge/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p-cash/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-p2p-cash/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-node/package.json	Adds lavamoat.allowScripts policy entries (including allowlisting bcrypt) for this package’s dependency tree.
packages/bitcore-mnemonic/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-ltc/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-ltc/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-doge/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-doge/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-lib-cash/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-lib-cash/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.
packages/bitcore-client/package.json	Adds lavamoat.allowScripts policy entries (including allowlisting bcrypt) for this package’s dependency tree.
packages/bitcore-cli/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-build/package.json	Adds lavamoat.allowScripts policy entries for this package’s dependency tree.
packages/bitcore-build/package-lock.json	Lockfile metadata updates consistent with refreshed dependency/script policy state.

Files not reviewed (7)

• packages/bitcore-build/package-lock.json: Generated file
• packages/bitcore-lib-cash/package-lock.json: Generated file
• packages/bitcore-lib-doge/package-lock.json: Generated file
• packages/bitcore-lib-ltc/package-lock.json: Generated file
• packages/bitcore-lib/package-lock.json: Generated file
• packages/bitcore-p2p-cash/package-lock.json: Generated file
• packages/bitcore-p2p/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.