chore(linea-ens-contracts): add lavamoat allow-scripts

[witmicko]

Summary

Add @lavamoat/allow-scripts across the workspace to mitigate the risk of executing unexpected lifecycle scripts from transitive dependencies.
Lavamoat allow-scripts does not affect runtime. Lavamoat at runtime is a separate integration

Motivation

npm lifecycle scripts can run arbitrary code during install. @lavamoat/allow-scripts enforces an explicit allowlist so only vetted scripts execute, reducing supply‑chain attack surface.

What changed

• Add @lavamoat/allow-scripts at the root and wire it into installs.
• Generate and commit per‑package allowScripts allowlists via allow-scripts auto.
• No runtime code changes.

Security considerations

• Narrows the set of install-time scripts to an audited allowlist.

Note

Introduces LavaMoat allow-scripts and disables lifecycle scripts for packages/linea-ens-contracts, adding an explicit allowlist policy to block install-time scripts from transitive deps.

• Install-time hardening:
  • Disable lifecycle scripts via Yarn config in packages/linea-ens-contracts/.yarnrc and .yarnrc.yml.
  • Add devDeps @lavamoat/allow-scripts and @lavamoat/preinstall-always-fail in packages/linea-ens-contracts/package.json.
  • Define lavamoat.allowScripts policy in package.json to deny install scripts for specified transitive packages.

^{Written by Cursor Bugbot for commit cc74d87. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lavamoat/​preinstall-always-fail@​2.1.1
	@​npmcli/​node-gyp@​3.0.0
	unique-slug@​4.0.0
	unique-filename@​3.0.0
	is-lambda@​1.0.1
	abbrev@​2.0.0
	promise-inflight@​1.0.1
	npm-install-checks@​6.3.0
	@​lavamoat/​aa@​4.3.4
	minipass-sized@​1.0.3
	read-cmd-shim@​4.0.0
	minipass-flush@​1.0.5
	minipass-collect@​2.0.1
	minipass-pipeline@​1.2.4
	isexe@​3.1.1
	@​pkgjs/​parseargs@​0.11.0
	retry@​0.12.0
	path-scurry@​1.11.1
	ip-address@​10.0.1
	https-proxy-agent@​7.0.6
	cmd-shim@​6.0.3
	minimatch@​9.0.5
	minipass-fetch@​3.0.5
	err-code@​2.0.3
	http-cache-semantics@​4.2.0
	agent-base@​7.1.4
	jackspeak@​3.4.3
	glob@​10.4.5
	socks-proxy-agent@​8.0.5
	socks@​2.8.7
	promise-retry@​2.0.1
	@​npmcli/​agent@​2.2.2
	which@​4.0.0
See 26 more rows in the dashboard

View full report