From 909acbc01ba7d974729c6bd70cc50bf870a92a64 Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Mon, 24 Aug 2026 13:04:31 +0200
Subject: [PATCH] Integrate `LavaMoat/harden`

Add the `LavaMoat/harden` setup, based on
https://github.com/MetaMask/metamask-module-template/pull/335.

This introduces a `lavamoat/` directory with config files containing
secure defaults for running scripts (`scripts.strict.json`,
`scripts.loose.json`, and `scripts.skills.json`), plus a banned
environment variable list, and a Yarn runner plugin that applies them.
The plugin wraps every `yarn run` script with Node's permission model,
restricting filesystem, network, child process, worker, addon, WASI,
and inspector access, filters sensitive environment variables out of
the script environment, and moves `node_modules/.bin` to the end of
`PATH` to prevent bin confusion attacks.

Each workspace now declares `scriptsConfig.#default` pointing at the
strict config, enforced by a new Yarn constraint. Yarn hardened mode is
enabled, `.npmrc` and `.yarnrc` are added to make accidental npm or
Yarn 1 usage safe, and Node is pinned to 26 since the permission model
requires a recent runtime.
---
 .npmrc                                        |   5 +
 .nvmrc                                        |   2 +-
 .oxfmtrc.json                                 |   2 +-
 .yarnrc                                       |   2 +
 .yarnrc.yml                                   |  15 +-
 eslint.config.mjs                             |   1 +
 lavamoat/.env.ban.json                        |   9 +
 lavamoat/.runner-plugin.js                    | 370 ++++++++++++++++++
 lavamoat/plugin-allow-scripts.js              |  17 +
 lavamoat/scripts.loose.json                   |  16 +
 lavamoat/scripts.skills.json                  |  14 +
 lavamoat/scripts.strict.json                  |  14 +
 package.json                                  |  11 +
 packages/account-tree-controller/package.json |   3 +
 packages/accounts-controller/package.json     |   3 +
 packages/address-book-controller/package.json |   3 +
 packages/ai-controllers/package.json          |   3 +
 packages/analytics-controller/package.json    |   3 +
 .../package.json                              |   3 +
 packages/announcement-controller/package.json |   3 +
 packages/app-metadata-controller/package.json |   3 +
 packages/approval-controller/package.json     |   3 +
 packages/assets-controller/package.json       |   3 +
 packages/assets-controllers/package.json      |   3 +
 .../authenticated-user-storage/package.json   |   3 +
 packages/base-controller/package.json         |   3 +
 packages/base-data-service/package.json       |   3 +
 packages/bitcoin-regtest-up/package.json      |   3 +
 packages/bridge-controller/package.json       |   3 +
 .../bridge-status-controller/package.json     |   3 +
 packages/build-utils/package.json             |   3 +
 .../chain-agnostic-permission/package.json    |   3 +
 packages/chomp-api-service/package.json       |   3 +
 packages/claims-controller/package.json       |   3 +
 packages/client-controller/package.json       |   3 +
 packages/client-utils/package.json            |   3 +
 packages/compliance-controller/package.json   |   3 +
 packages/composable-controller/package.json   |   3 +
 .../config-registry-controller/package.json   |   3 +
 packages/connectivity-controller/package.json |   3 +
 packages/controller-utils/package.json        |   3 +
 packages/core-backend/package.json            |   3 +
 packages/delegation-controller/package.json   |   3 +
 packages/earn-controller/package.json         |   3 +
 packages/eip-5792-middleware/package.json     |   3 +
 .../package.json                              |   3 +
 .../package.json                              |   3 +
 packages/eth-block-tracker/package.json       |   3 +
 packages/eth-json-rpc-middleware/package.json |   3 +
 packages/eth-json-rpc-provider/package.json   |   3 +
 packages/foundryup/package.json               |   3 +
 packages/gas-fee-controller/package.json      |   3 +
 .../gator-permissions-controller/package.json |   3 +
 packages/geolocation-controller/package.json  |   3 +
 packages/java-tron-up/package.json            |   3 +
 packages/json-rpc-engine/package.json         |   3 +
 .../json-rpc-middleware-stream/package.json   |   3 +
 packages/keyring-controller/package.json      |   3 +
 packages/kyc-controller/package.json          |   3 +
 packages/local-node-utils/package.json        |   3 +
 packages/logging-controller/package.json      |   3 +
 packages/message-manager/package.json         |   3 +
 packages/messenger-cli/package.json           |   3 +
 packages/messenger/package.json               |   3 +
 .../package.json                              |   3 +
 .../package.json                              |   3 +
 .../money-account-controller/package.json     |   3 +
 .../package.json                              |   3 +
 packages/money-account-utils/package.json     |   3 +
 .../multichain-account-service/package.json   |   3 +
 .../multichain-api-middleware/package.json    |   3 +
 .../package.json                              |   3 +
 .../package.json                              |   3 +
 packages/name-controller/package.json         |   3 +
 .../package.json                              |   3 +
 packages/network-controller/package.json      |   3 +
 .../package.json                              |   3 +
 .../package.json                              |   3 +
 packages/passkey-controller/package.json      |   3 +
 packages/permission-controller/package.json   |   3 +
 .../permission-log-controller/package.json    |   3 +
 packages/perps-controller/package.json        |   3 +
 packages/phishing-controller/package.json     |   3 +
 packages/platform-api-docs/package.json       |   3 +
 packages/polling-controller/package.json      |   3 +
 packages/preferences-controller/package.json  |   3 +
 .../profile-metrics-controller/package.json   |   3 +
 packages/profile-sync-controller/package.json |   3 +
 packages/ramps-controller/package.json        |   3 +
 packages/rate-limit-controller/package.json   |   3 +
 packages/react-data-query/package.json        |   3 +
 .../package.json                              |   3 +
 packages/sample-controllers/package.json      |   3 +
 .../package.json                              |   3 +
 .../selected-network-controller/package.json  |   3 +
 packages/sentinel-api-service/package.json    |   3 +
 packages/shield-controller/package.json       |   3 +
 packages/signature-controller/package.json    |   3 +
 .../package.json                              |   3 +
 packages/snap-account-service/package.json    |   3 +
 packages/social-controllers/package.json      |   3 +
 .../solana-test-validator-up/package.json     |   3 +
 packages/stellar-quickstart-up/package.json   |   3 +
 packages/storage-service/package.json         |   3 +
 packages/subscription-controller/package.json |   3 +
 packages/transaction-controller/package.json  |   3 +
 .../transaction-pay-controller/package.json   |   3 +
 .../user-operation-controller/package.json    |   3 +
 packages/wallet-cli/package.json              |   3 +
 packages/wallet-framework-docs/package.json   |   3 +
 packages/wallet/package.json                  |   3 +
 yarn.config.cjs                               |   6 +
 112 files changed, 774 insertions(+), 4 deletions(-)
 create mode 100644 .npmrc
 create mode 100644 .yarnrc
 create mode 100644 lavamoat/.env.ban.json
 create mode 100755 lavamoat/.runner-plugin.js
 create mode 100644 lavamoat/plugin-allow-scripts.js
 create mode 100644 lavamoat/scripts.loose.json
 create mode 100644 lavamoat/scripts.skills.json
 create mode 100644 lavamoat/scripts.strict.json

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000000..15d263ad343
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,5 @@
+## Make using npm impossible.
+offline=true
+
+## Ignore scripts just in case.
+ignore-scripts=true
diff --git a/.nvmrc b/.nvmrc
index b009dfb9d9f..6f4247a6255 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-lts/*
+26
diff --git a/.oxfmtrc.json b/.oxfmtrc.json
index b5e76ee140b..850fd7035e5 100644
--- a/.oxfmtrc.json
+++ b/.oxfmtrc.json
@@ -16,5 +16,5 @@
   },
   "tabWidth": 2,
   "trailingComma": "all",
-  "ignorePatterns": [".yarnrc.yml", "merged-packages/**"]
+  "ignorePatterns": [".yarnrc.yml", "merged-packages/**", "lavamoat"]
 }
diff --git a/.yarnrc b/.yarnrc
new file mode 100644
index 00000000000..c136bd0fa11
--- /dev/null
+++ b/.yarnrc
@@ -0,0 +1,2 @@
+## Ignore scripts in case yarn1 is accidentally used.
+ignore-scripts true
diff --git a/.yarnrc.yml b/.yarnrc.yml
index 03ae3081348..b6835da6678 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -7,10 +7,20 @@ compressionLevel: mixed
 
 enableGlobalCache: false
 
+# Hardened mode to validate lockfile content against remote registries.
+enableHardenedMode: true
+
+# Disable Yarn's mirror feature to avoid writing to the global cache.
+enableMirror: false
+
 enableScripts: false
 
 enableTelemetry: false
 
+# Despite `enableGlobalCache` and `enableMirror` being `false`, Yarn is still
+# writing to the global folder.
+globalFolder: .yarn/global
+
 logFilters:
   - code: YN0004
     level: discard
@@ -29,6 +39,7 @@ npmPreapprovedPackages:
   - "@lavamoat/*"
   - "@ts-bridge/*"
 
+# Protect the runtime of calls to "yarn run" scripts using a local plugin.
 plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
-    spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"
+  - path: ./lavamoat/plugin-allow-scripts.js
+  - path: ./lavamoat/.runner-plugin.js
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 297616d0ddb..a3faef6bbc9 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -81,6 +81,7 @@ const config = createConfig([
       '.platform-api-docs/**',
       '.skills-cache/**',
       '.yarn/**',
+      'lavamoat/',
       'merged-packages/**',
       'packages/wallet-framework-docs/site/build/**',
       'scripts/create-package/package-template/**',
diff --git a/lavamoat/.env.ban.json b/lavamoat/.env.ban.json
new file mode 100644
index 00000000000..4d4ed65eac9
--- /dev/null
+++ b/lavamoat/.env.ban.json
@@ -0,0 +1,9 @@
+[
+  "SESSION",
+  "SSH",
+  "KEY",
+  "TOKEN",
+  "SECRET",
+  "PASSWORD",
+  "AUTH"
+]
diff --git a/lavamoat/.runner-plugin.js b/lavamoat/.runner-plugin.js
new file mode 100755
index 00000000000..9acee99fda5
--- /dev/null
+++ b/lavamoat/.runner-plugin.js
@@ -0,0 +1,370 @@
+/**
+ * Yarn 4 plugin for script environment hardening.
+ *
+ * @module
+ */
+
+/** @typedef {NonNullable<import('@yarnpkg/core').Hooks['wrapScriptExecution']>} WrapScriptExecutionHook */
+
+/* global makeRunScriptWrapper */
+
+/**
+ * Yarn 4 plugin factory for wrapScriptExecution hook.
+ *
+ * @param {any} require - Yarn's require function
+ * @returns {{ hooks: { wrapScriptExecution: Function } }}
+ */
+module.exports = {
+  name: '@yarnpkg/plugin-runner',
+  factory: function (/** @type {NodeJS.Require} */ require) {
+    const { tmpdir } = require('node:os')
+    return {
+      hooks: {
+        /** @type {WrapScriptExecutionHook} */
+        wrapScriptExecution: async (
+          executor,
+          project,
+          locator,
+          scriptName,
+          extra
+        ) => {
+          const path = require('node:path')
+          const fs = require('node:fs')
+          const workspace = project.tryWorkspaceByLocator(locator)
+
+          if (!workspace) {
+            // a script is being executed outside of a workspace context, so we
+            // can't apply any custom logic.
+            // This is the case when a postinstal is running.
+
+            // "Do nothing" - return the original executor immediately
+            // without running any custom plugin logic or reading manifests.
+            // TODO: implement wrapping these scripts with reasonable defaults
+            return executor
+          }
+
+          const pkgJson = workspace.manifest.raw
+          const binFolder =
+            extra.env.BERRY_BIN_FOLDER || `node_modules${path.sep}.bin`
+
+          const wrapper = makeRunScriptWrapper(
+            {
+              scriptName,
+              scriptPayload: extra.script,
+              projectRoot: extra.cwd,
+              pathBinMatcher: (fragment) => {
+                return fragment.endsWith(binFolder)
+              },
+              customizePermissionsConfig: addMandatoryReads,
+              readScriptsConfig: () => {
+                return pkgJson.scriptsConfig
+              },
+            },
+            {
+              readFileSync: fs.readFileSync,
+              pathJoin: path.join,
+              pathDelimiter: path.delimiter,
+              tmpdir,
+              realpathSync: fs.realpathSync,
+            }
+          )
+
+          // extra.env is a reference to the mutable object, but a different variable
+          // containing that reference is used within execute, so we must amend not
+          // replace it.
+          const newEnv = wrapper.processEnv(extra.env)
+          for (const key of Object.keys(extra.env)) {
+            delete extra.env[key]
+          }
+          Object.assign(extra.env, newEnv)
+          return executor
+        },
+      },
+    }
+  },
+}
+
+/**
+ * @param {Record<string, boolean | string | string[]>} configOptions
+ * @param {NodeJS.ProcessEnv} _env
+ */
+function addMandatoryReads(configOptions, _env) {
+  if (!configOptions['--permission']) {
+    return
+  }
+  configOptions['--allow-fs-tmp'] = true // yarn always uses tmp dirs.
+}
+
+;;
+/// <reference path="./makeRunScriptWrapper.global.d.ts" />
+
+/**
+ * @param {MakeRunScriptWrapperOptions} param0
+ * @param {MakeRunScriptWrapperIO} param1
+ * @returns {MakeRunScriptWrapper}
+ */
+function makeRunScriptWrapper(
+  {
+    scriptName,
+    scriptPayload: _scriptPayload, // might be useful to read in the future
+    projectRoot,
+    pathBinMatcher,
+    customizePermissionsConfig,
+    readScriptsConfig,
+  },
+  { readFileSync, pathJoin, pathDelimiter, tmpdir, realpathSync }
+) {
+  const DEFAULT_PERMISSION_KEY = '#default'
+
+  /** @param {string} filePath */
+  function readJsonFile(filePath) {
+    return JSON.parse(readFileSync(filePath, 'utf8'))
+  }
+
+  /**
+   * @param {object} opts
+   * @param {Record<string, string> | undefined} opts.scriptsConfig
+   * @param {string} [opts.scriptName]
+   * @param {string} opts.projectRoot
+   */
+  function readConfig({
+    scriptsConfig,
+    scriptName = DEFAULT_PERMISSION_KEY,
+    projectRoot,
+  }) {
+    if (!scriptsConfig) {
+      return {}
+    }
+    const configName =
+      scriptsConfig[scriptName] || scriptsConfig[DEFAULT_PERMISSION_KEY]
+
+    // config needs to be optional, because it's opt-in first and specifying a default turns it opt-out.
+    if (!configName) {
+      return {}
+    }
+    const configPath = pathJoin(projectRoot, configName)
+    let conf
+    try {
+      conf = readJsonFile(configPath)
+      if (typeof conf !== 'object' || conf === null) {
+        throw Error(`Expected an object, got ${typeof conf}`)
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      throw Error(
+        `[LavaMoat] Error loading script config file "${configPath}": ${message}`,
+        { cause: err }
+      )
+    }
+    return conf
+  }
+
+  /**
+   * Adds features we'd want in Node.js permissions model and intend to
+   * eventually upstream
+   *
+   * @param {ConfigOptions} configOptions
+   * @param {NodeJS.ProcessEnv} env
+   * @returns {void}
+   */
+  function permissionsModelCompatibilityExtensions(configOptions, env) {
+    // 1. support env variables as values in allow-fs-*
+    /**
+     * @param {string} value
+     * @returns {string}
+     */
+    const replaceEnvVar = (value) => {
+      const envVarMatch = value.match(/^\$([A-Z_][A-Z0-9_]*)$/i)
+      if (envVarMatch) {
+        const envVarName = envVarMatch[1]
+        if (env[envVarName] !== undefined) {
+          return env[envVarName]
+        } else {
+          console.error(
+            `[LavaMoat] Environment variable "${envVarName}" referenced in config but not found in environment`
+          )
+        }
+      }
+      return value
+    }
+
+    for (const key of ['--allow-fs-read', '--allow-fs-write']) {
+      if (Array.isArray(configOptions[key])) {
+        configOptions[key] = configOptions[key].map(replaceEnvVar)
+      }
+    }
+
+    // 2. tmp write - crossplatform
+    if (configOptions['--allow-fs-tmp'] === true) {
+      delete configOptions['--allow-fs-tmp']
+      if (configOptions['--allow-fs-write']) {
+        if (typeof configOptions['--allow-fs-write'] === 'string') {
+          configOptions['--allow-fs-write'] = [
+            configOptions['--allow-fs-write'],
+          ]
+        }
+        if (configOptions['--allow-fs-write'] === true) {
+          return // none of this matters
+        }
+      } else {
+        // do this for both undefined and false
+        configOptions['--allow-fs-write'] = []
+      }
+      const tmp = tmpdir()
+      configOptions['--allow-fs-write'].push(tmp)
+      // because macos is being weird
+      const tmpRealPath = realpathSync(tmp)
+      if (tmpRealPath !== tmp) {
+        configOptions['--allow-fs-write'].push(tmpRealPath)
+      }
+    }
+  }
+
+  /** @param {ConfigOptions} configOptions */
+  function makeFlagsFromConfig(configOptions) {
+    return Object.entries(configOptions)
+      .map(([arg, value]) => {
+        if (typeof value === 'boolean') {
+          return value ? arg : ''
+        } else if (Array.isArray(value)) {
+          return value.map((v) => `${arg}="${v}"`).join(' ')
+        } else {
+          return `${arg}="${value}"`
+        }
+      })
+      .filter(Boolean)
+      .join(' ')
+  }
+
+  /**
+   * Checks the config obtained from package.json and puts it in as NODE_OPTIONS
+   *
+   * @param {string | undefined} existingOptions
+   * @param {ConfigOptions} configOptions
+   * @param {NodeJS.ProcessEnv} env
+   */
+  function installNodeOptions(existingOptions, configOptions, env) {
+    if (!configOptions) {
+      return existingOptions || ''
+    }
+
+    customizePermissionsConfig(configOptions, env)
+
+    permissionsModelCompatibilityExtensions(configOptions, env)
+
+    const confOption = makeFlagsFromConfig(configOptions)
+
+    return `${existingOptions || ''} ${confOption.trim()}`.trim()
+  }
+
+  /**
+   * Filter environment variables based on ban keywords
+   *
+   * @param {NodeJS.ProcessEnv} env
+   * @param {string} lavamoatDir
+   * @returns {NodeJS.ProcessEnv}
+   */
+  function filterEnv(env, lavamoatDir) {
+    const banFilePath = pathJoin(lavamoatDir, '.env.ban.json')
+    let banConfig
+
+    try {
+      banConfig = readJsonFile(banFilePath)
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      console.error(
+        `[LavaMoat] Warning: Failed to read .env.ban.json: ${message}.`
+      )
+      return env
+    }
+    let banKeywords = []
+    try {
+      if (Array.isArray(banConfig)) {
+        banKeywords.push(...banConfig)
+      } else {
+        throw Error(`Expected .env.ban.json to contain an array of keywords`)
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      console.error(
+        `[LavaMoat] Warning: Failed to read .env.ban.json: ${message}.`
+      )
+      return env
+    }
+
+    /** @type {NodeJS.ProcessEnv} */
+    const filteredEnv = {}
+    const bannedEnv = []
+    banKeywords = banKeywords.map((keyword) => keyword.toLowerCase())
+    for (const [key, value] of Object.entries(env)) {
+      if (
+        !key.toLowerCase().startsWith('npm_config') &&
+        banKeywords.some((keyword) => key.toLowerCase().includes(keyword))
+      ) {
+        bannedEnv.push(key)
+      } else {
+        filteredEnv[key] = value
+      }
+    }
+    if (bannedEnv.length > 0) {
+      console.error(
+        `[LavaMoat] Warning: The following environment variables were banned: ${bannedEnv.join(', ')}`
+      )
+    }
+    return filteredEnv
+  }
+
+  /** @param {string} PATH */
+  function envPathOpinions(PATH) {
+    const pathFragments = PATH.split(pathDelimiter)
+    // This is to eliminate bin confusion attacks.
+    // Find node_modules/.bin and remove it, put it on the end that gets looked up last when looking for a name in the path.
+
+    /** @type {string[]} */
+    const filteredFragments = []
+    /** @type {string[]} */
+    const nodeModulesBinFragments = []
+
+    for (const fragment of pathFragments) {
+      if (pathBinMatcher(fragment)) {
+        nodeModulesBinFragments.push(fragment)
+      } else {
+        filteredFragments.push(fragment)
+      }
+    }
+    // Why would there be multiple bin fragments? In a npm workspace, local bin and workspace root bin is added
+    filteredFragments.push(...nodeModulesBinFragments)
+    return filteredFragments.join(pathDelimiter)
+  }
+
+  return {
+    processEnv: (existingEnv) => {
+      const scriptsConfig = readScriptsConfig(projectRoot)
+      const config = readConfig({
+        scriptsConfig,
+        scriptName,
+        projectRoot,
+      })
+
+      // Smell: Windows environment variables are case-insensitive, but Node's process.env
+      // might expose it as 'Path' instead of 'PATH'. Checking both ensures it doesn't get wiped out.
+
+      const existingPath = existingEnv.PATH || existingEnv.Path || ''
+
+      const lavamoatDir = pathJoin(projectRoot, 'lavamoat')
+
+      const fixedEnv = {
+        ...filterEnv(existingEnv, lavamoatDir),
+        PATH: envPathOpinions(existingPath),
+        NODE_OPTIONS: installNodeOptions(
+          existingEnv.NODE_OPTIONS,
+          config.nodeOptions,
+          existingEnv
+        ),
+      }
+      return fixedEnv
+    },
+  }
+}
+
+
diff --git a/lavamoat/plugin-allow-scripts.js b/lavamoat/plugin-allow-scripts.js
new file mode 100644
index 00000000000..fbd0f019daf
--- /dev/null
+++ b/lavamoat/plugin-allow-scripts.js
@@ -0,0 +1,17 @@
+//prettier-ignore
+module.exports = {
+name: "@yarnpkg/plugin-allow-scripts",
+factory: function (/** @type {(arg0: string) => { execute: any; }} */ require) {
+    const { execute } = require(`@yarnpkg/shell`);
+    return {
+      hooks: {
+        afterAllInstalled: async () => {
+          const exitCode = await execute('yarn run allow-scripts')
+          if (exitCode !== 0) {
+            process.exit(exitCode)
+          }
+        },
+      },
+    }
+  }
+};
diff --git a/lavamoat/scripts.loose.json b/lavamoat/scripts.loose.json
new file mode 100644
index 00000000000..d255c351fbb
--- /dev/null
+++ b/lavamoat/scripts.loose.json
@@ -0,0 +1,16 @@
+{
+  "notes": "Should prevent basic malicious behavior of writing to locations outside the project and sending network requests, but not break any of the advanced packages in use. Everything below the net permission can be used to bypass the restrictions by a more sophisticated attacker. The warnings are suppressed. You should strive to deny as many native capabilities as possible and limit the fs-read to not have access to your entire home folder.",
+  "nodeOptions": {
+    "--permission": true,
+    "--allow-fs-read": ["/", "$npm_config_prefix", "$npm_config_userconfig"],
+    "--allow-fs-write": ["./"],
+    "--allow-fs-tmp": true,
+    "--allow-net": false,
+    "--allow-child-process": true,
+    "--allow-worker": true,
+    "--allow-addons": true,
+    "--allow-wasi": true,
+    "--allow-inspector": false,
+    "--disable-warning": "SecurityWarning"
+  }
+}
diff --git a/lavamoat/scripts.skills.json b/lavamoat/scripts.skills.json
new file mode 100644
index 00000000000..db0d36cf7e3
--- /dev/null
+++ b/lavamoat/scripts.skills.json
@@ -0,0 +1,14 @@
+{
+  "notes": "Should prevent basic malicious behavior of writing to locations outside the project and sending network requests, but not break any of the advanced packages in use. Everything below the net permission can be used to bypass the restrictions by a more sophisticated attacker.",
+  "nodeOptions": {
+    "--permission": true,
+    "--allow-fs-read": ["./"],
+    "--allow-fs-write": ["./"],
+    "--allow-child-process": true,
+    "--allow-net": false,
+    "--allow-worker": false,
+    "--allow-addons": false,
+    "--allow-wasi": false,
+    "--allow-inspector": false
+  }
+}
diff --git a/lavamoat/scripts.strict.json b/lavamoat/scripts.strict.json
new file mode 100644
index 00000000000..40a815933e5
--- /dev/null
+++ b/lavamoat/scripts.strict.json
@@ -0,0 +1,14 @@
+{
+  "notes": "Denies all powerful IO capabilities that a linter script should not need. If a script needs more permissions, copy this file and edit.",
+  "nodeOptions": {
+    "--permission": true,
+    "--allow-fs-read": ["./"],
+    "--allow-fs-write": ["./"],
+    "--allow-child-process": false,
+    "--allow-net": false,
+    "--allow-worker": false,
+    "--allow-addons": false,
+    "--allow-wasi": false,
+    "--allow-inspector": false
+  }
+}
diff --git a/package.json b/package.json
index c5fb7d40b2b..7424091dff5 100644
--- a/package.json
+++ b/package.json
@@ -124,6 +124,13 @@
   "simple-git-hooks": {
     "pre-push": "yarn lint"
   },
+  "devEngines": {
+    "packageManager": {
+      "name": "yarn",
+      "version": ">=4.16.0+sha256.ba05224324578801b9cc98170d64aa50b9a36733b440fb0942306da3fbbdc7d1",
+      "onFail": "error"
+    }
+  },
   "engines": {
     "node": "^18.18 || >=20"
   },
@@ -139,5 +146,9 @@
       "tsx>esbuild": false,
       "jest>@jest/core>jest-resolve>unrs-resolver": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json",
+    "skills:postinstall": "lavamoat/scripts.skills.json"
   }
 }
diff --git a/packages/account-tree-controller/package.json b/packages/account-tree-controller/package.json
index 33048bf3a19..bb278252ff3 100644
--- a/packages/account-tree-controller/package.json
+++ b/packages/account-tree-controller/package.json
@@ -92,5 +92,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/accounts-controller/package.json b/packages/accounts-controller/package.json
index 05b980d330c..9475cbc1828 100644
--- a/packages/accounts-controller/package.json
+++ b/packages/accounts-controller/package.json
@@ -94,5 +94,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/address-book-controller/package.json b/packages/address-book-controller/package.json
index 47befdfcc72..427209580d7 100644
--- a/packages/address-book-controller/package.json
+++ b/packages/address-book-controller/package.json
@@ -74,5 +74,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/ai-controllers/package.json b/packages/ai-controllers/package.json
index b2203c75d28..a2e5ed84b03 100644
--- a/packages/ai-controllers/package.json
+++ b/packages/ai-controllers/package.json
@@ -74,5 +74,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/analytics-controller/package.json b/packages/analytics-controller/package.json
index 8f88b8325ef..d2c7d38ca01 100644
--- a/packages/analytics-controller/package.json
+++ b/packages/analytics-controller/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/analytics-data-regulation-controller/package.json b/packages/analytics-data-regulation-controller/package.json
index 71facec5a66..9c4b9982bf1 100644
--- a/packages/analytics-data-regulation-controller/package.json
+++ b/packages/analytics-data-regulation-controller/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/announcement-controller/package.json b/packages/announcement-controller/package.json
index a525df3583e..01806c09368 100644
--- a/packages/announcement-controller/package.json
+++ b/packages/announcement-controller/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/app-metadata-controller/package.json b/packages/app-metadata-controller/package.json
index 0e9cd734451..ed2d696531e 100644
--- a/packages/app-metadata-controller/package.json
+++ b/packages/app-metadata-controller/package.json
@@ -70,5 +70,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/approval-controller/package.json b/packages/approval-controller/package.json
index 22bead46135..a7a4169f6f6 100644
--- a/packages/approval-controller/package.json
+++ b/packages/approval-controller/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/assets-controller/package.json b/packages/assets-controller/package.json
index 3d17252a3c0..baa0f781f5a 100644
--- a/packages/assets-controller/package.json
+++ b/packages/assets-controller/package.json
@@ -102,5 +102,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/assets-controllers/package.json b/packages/assets-controllers/package.json
index d3cf2c6c45c..a0413bb3e88 100644
--- a/packages/assets-controllers/package.json
+++ b/packages/assets-controllers/package.json
@@ -132,5 +132,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/authenticated-user-storage/package.json b/packages/authenticated-user-storage/package.json
index d0df70909be..11ef8aaa1f4 100644
--- a/packages/authenticated-user-storage/package.json
+++ b/packages/authenticated-user-storage/package.json
@@ -76,5 +76,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/base-controller/package.json b/packages/base-controller/package.json
index 2d08ff61bd3..a7707950867 100644
--- a/packages/base-controller/package.json
+++ b/packages/base-controller/package.json
@@ -70,5 +70,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/base-data-service/package.json b/packages/base-data-service/package.json
index 0ba3f0fb40c..f86a75ba07e 100644
--- a/packages/base-data-service/package.json
+++ b/packages/base-data-service/package.json
@@ -80,5 +80,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/bitcoin-regtest-up/package.json b/packages/bitcoin-regtest-up/package.json
index dfc8d44e055..b2ad287f270 100644
--- a/packages/bitcoin-regtest-up/package.json
+++ b/packages/bitcoin-regtest-up/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/bridge-controller/package.json b/packages/bridge-controller/package.json
index 7ede6d92800..02f6f173fb8 100644
--- a/packages/bridge-controller/package.json
+++ b/packages/bridge-controller/package.json
@@ -99,5 +99,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/bridge-status-controller/package.json b/packages/bridge-status-controller/package.json
index 365a1d72c25..29d4c10c92d 100644
--- a/packages/bridge-status-controller/package.json
+++ b/packages/bridge-status-controller/package.json
@@ -88,5 +88,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/build-utils/package.json b/packages/build-utils/package.json
index d0ecfb261b0..21e1e4c0742 100644
--- a/packages/build-utils/package.json
+++ b/packages/build-utils/package.json
@@ -70,5 +70,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/chain-agnostic-permission/package.json b/packages/chain-agnostic-permission/package.json
index 7d3daad684a..28e021f60ac 100644
--- a/packages/chain-agnostic-permission/package.json
+++ b/packages/chain-agnostic-permission/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/chomp-api-service/package.json b/packages/chomp-api-service/package.json
index e016265262c..c560f9aa30e 100644
--- a/packages/chomp-api-service/package.json
+++ b/packages/chomp-api-service/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/claims-controller/package.json b/packages/claims-controller/package.json
index 3edf7d6f06c..8de78cf0412 100644
--- a/packages/claims-controller/package.json
+++ b/packages/claims-controller/package.json
@@ -79,5 +79,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/client-controller/package.json b/packages/client-controller/package.json
index 6dc63fee15b..a7055fa9b00 100644
--- a/packages/client-controller/package.json
+++ b/packages/client-controller/package.json
@@ -73,5 +73,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/client-utils/package.json b/packages/client-utils/package.json
index 065968888ee..1b086c4c58a 100644
--- a/packages/client-utils/package.json
+++ b/packages/client-utils/package.json
@@ -79,5 +79,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/compliance-controller/package.json b/packages/compliance-controller/package.json
index e9dfa2e978e..b2bd86869b0 100644
--- a/packages/compliance-controller/package.json
+++ b/packages/compliance-controller/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/composable-controller/package.json b/packages/composable-controller/package.json
index 95e8c1cce5c..d90ac4d2a8d 100644
--- a/packages/composable-controller/package.json
+++ b/packages/composable-controller/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/config-registry-controller/package.json b/packages/config-registry-controller/package.json
index 9f93949dc65..372b77bb7e2 100644
--- a/packages/config-registry-controller/package.json
+++ b/packages/config-registry-controller/package.json
@@ -82,5 +82,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/connectivity-controller/package.json b/packages/connectivity-controller/package.json
index eff0dab23f5..d62b39be194 100644
--- a/packages/connectivity-controller/package.json
+++ b/packages/connectivity-controller/package.json
@@ -73,5 +73,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/controller-utils/package.json b/packages/controller-utils/package.json
index bd5cd75ee2d..64f8fe8d00a 100644
--- a/packages/controller-utils/package.json
+++ b/packages/controller-utils/package.json
@@ -87,5 +87,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/core-backend/package.json b/packages/core-backend/package.json
index af9f6eb7f7c..b94aef3fb33 100644
--- a/packages/core-backend/package.json
+++ b/packages/core-backend/package.json
@@ -82,5 +82,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/delegation-controller/package.json b/packages/delegation-controller/package.json
index 2aba87d6072..c7b0898ce89 100644
--- a/packages/delegation-controller/package.json
+++ b/packages/delegation-controller/package.json
@@ -74,5 +74,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/earn-controller/package.json b/packages/earn-controller/package.json
index f8207fd7cbc..fc5d49c9948 100644
--- a/packages/earn-controller/package.json
+++ b/packages/earn-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eip-5792-middleware/package.json b/packages/eip-5792-middleware/package.json
index 7759c232d42..874092e083c 100644
--- a/packages/eip-5792-middleware/package.json
+++ b/packages/eip-5792-middleware/package.json
@@ -78,5 +78,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eip-7702-internal-rpc-middleware/package.json b/packages/eip-7702-internal-rpc-middleware/package.json
index 00178ffe9d4..5c76cf0ed41 100644
--- a/packages/eip-7702-internal-rpc-middleware/package.json
+++ b/packages/eip-7702-internal-rpc-middleware/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eip1193-permission-middleware/package.json b/packages/eip1193-permission-middleware/package.json
index d83f2d94e98..51d0c907f63 100644
--- a/packages/eip1193-permission-middleware/package.json
+++ b/packages/eip1193-permission-middleware/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eth-block-tracker/package.json b/packages/eth-block-tracker/package.json
index bf2d8c49b59..4bba59d49e5 100644
--- a/packages/eth-block-tracker/package.json
+++ b/packages/eth-block-tracker/package.json
@@ -76,5 +76,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eth-json-rpc-middleware/package.json b/packages/eth-json-rpc-middleware/package.json
index 72e879947e8..b170707ad0b 100644
--- a/packages/eth-json-rpc-middleware/package.json
+++ b/packages/eth-json-rpc-middleware/package.json
@@ -87,5 +87,8 @@
       "@metamask/eth-sig-util>ethereumjs-util>ethereum-cryptography>secp256k1": false,
       "eslint-plugin-import-x>unrs-resolver": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/eth-json-rpc-provider/package.json b/packages/eth-json-rpc-provider/package.json
index 10937f23d58..894874543a7 100644
--- a/packages/eth-json-rpc-provider/package.json
+++ b/packages/eth-json-rpc-provider/package.json
@@ -80,5 +80,8 @@
     "allowScripts": {
       "@lavamoat/preinstall-always-fail": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/foundryup/package.json b/packages/foundryup/package.json
index 4ab1f0c17f3..17d2abf1d1f 100644
--- a/packages/foundryup/package.json
+++ b/packages/foundryup/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/gas-fee-controller/package.json b/packages/gas-fee-controller/package.json
index 4476a21f9f6..f4a4aac9663 100644
--- a/packages/gas-fee-controller/package.json
+++ b/packages/gas-fee-controller/package.json
@@ -89,5 +89,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/gator-permissions-controller/package.json b/packages/gator-permissions-controller/package.json
index 815e0e9b9de..537a089fb4d 100644
--- a/packages/gator-permissions-controller/package.json
+++ b/packages/gator-permissions-controller/package.json
@@ -89,5 +89,8 @@
     "allowScripts": {
       "@lavamoat/preinstall-always-fail": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/geolocation-controller/package.json b/packages/geolocation-controller/package.json
index f20e31aa972..a460675b85b 100644
--- a/packages/geolocation-controller/package.json
+++ b/packages/geolocation-controller/package.json
@@ -73,5 +73,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/java-tron-up/package.json b/packages/java-tron-up/package.json
index 6d66d1451ef..dfcb7b3c7cb 100644
--- a/packages/java-tron-up/package.json
+++ b/packages/java-tron-up/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/json-rpc-engine/package.json b/packages/json-rpc-engine/package.json
index 591502a5689..4631961137e 100644
--- a/packages/json-rpc-engine/package.json
+++ b/packages/json-rpc-engine/package.json
@@ -95,5 +95,8 @@
     "allowScripts": {
       "@lavamoat/preinstall-always-fail": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/json-rpc-middleware-stream/package.json b/packages/json-rpc-middleware-stream/package.json
index 97eeee728fe..b4f7bc296f8 100644
--- a/packages/json-rpc-middleware-stream/package.json
+++ b/packages/json-rpc-middleware-stream/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/keyring-controller/package.json b/packages/keyring-controller/package.json
index 6b610f26a29..ea9dc60974f 100644
--- a/packages/keyring-controller/package.json
+++ b/packages/keyring-controller/package.json
@@ -101,5 +101,8 @@
       "ethereumjs-wallet>ethereum-cryptography>keccak": false,
       "ethereumjs-wallet>ethereum-cryptography>secp256k1": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/kyc-controller/package.json b/packages/kyc-controller/package.json
index ffa8371034a..9cb138d0297 100644
--- a/packages/kyc-controller/package.json
+++ b/packages/kyc-controller/package.json
@@ -89,5 +89,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/local-node-utils/package.json b/packages/local-node-utils/package.json
index 575f2286b30..b1671c1a890 100644
--- a/packages/local-node-utils/package.json
+++ b/packages/local-node-utils/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/logging-controller/package.json b/packages/logging-controller/package.json
index 08cd7e5f5ef..a9b76bb7731 100644
--- a/packages/logging-controller/package.json
+++ b/packages/logging-controller/package.json
@@ -74,5 +74,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/message-manager/package.json b/packages/message-manager/package.json
index 2a49919373f..08b24e22367 100644
--- a/packages/message-manager/package.json
+++ b/packages/message-manager/package.json
@@ -76,5 +76,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/messenger-cli/package.json b/packages/messenger-cli/package.json
index ac25ea88a86..4f225e1081a 100644
--- a/packages/messenger-cli/package.json
+++ b/packages/messenger-cli/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/messenger/package.json b/packages/messenger/package.json
index 034e0b46bd6..476967c904d 100644
--- a/packages/messenger/package.json
+++ b/packages/messenger/package.json
@@ -78,5 +78,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/money-account-api-data-service/package.json b/packages/money-account-api-data-service/package.json
index 497d3c30d18..b70f2929940 100644
--- a/packages/money-account-api-data-service/package.json
+++ b/packages/money-account-api-data-service/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/money-account-balance-service/package.json b/packages/money-account-balance-service/package.json
index 853dc4133b6..f6b5b727967 100644
--- a/packages/money-account-balance-service/package.json
+++ b/packages/money-account-balance-service/package.json
@@ -82,5 +82,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/money-account-controller/package.json b/packages/money-account-controller/package.json
index bb8e8358fcf..8f1433a6321 100644
--- a/packages/money-account-controller/package.json
+++ b/packages/money-account-controller/package.json
@@ -79,5 +79,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/money-account-upgrade-controller/package.json b/packages/money-account-upgrade-controller/package.json
index 2ea073b579a..9f501adaf1d 100644
--- a/packages/money-account-upgrade-controller/package.json
+++ b/packages/money-account-upgrade-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/money-account-utils/package.json b/packages/money-account-utils/package.json
index 9a032e441a9..733bbeadc9d 100644
--- a/packages/money-account-utils/package.json
+++ b/packages/money-account-utils/package.json
@@ -75,5 +75,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/multichain-account-service/package.json b/packages/multichain-account-service/package.json
index 0a90c7240fa..35189e6111a 100644
--- a/packages/multichain-account-service/package.json
+++ b/packages/multichain-account-service/package.json
@@ -100,5 +100,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/multichain-api-middleware/package.json b/packages/multichain-api-middleware/package.json
index 7212fd2ef60..ddcc9f6a167 100644
--- a/packages/multichain-api-middleware/package.json
+++ b/packages/multichain-api-middleware/package.json
@@ -84,5 +84,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/multichain-network-controller/package.json b/packages/multichain-network-controller/package.json
index 6cc97c379a8..2a23352a517 100644
--- a/packages/multichain-network-controller/package.json
+++ b/packages/multichain-network-controller/package.json
@@ -86,5 +86,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/multichain-transactions-controller/package.json b/packages/multichain-transactions-controller/package.json
index 5ee87a5d6f3..5c681258410 100644
--- a/packages/multichain-transactions-controller/package.json
+++ b/packages/multichain-transactions-controller/package.json
@@ -85,5 +85,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/name-controller/package.json b/packages/name-controller/package.json
index 6e21b5bbc27..c1de1734e61 100644
--- a/packages/name-controller/package.json
+++ b/packages/name-controller/package.json
@@ -76,5 +76,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/network-connection-banner-controller/package.json b/packages/network-connection-banner-controller/package.json
index 43a61177d3c..7fdc798a2da 100644
--- a/packages/network-connection-banner-controller/package.json
+++ b/packages/network-connection-banner-controller/package.json
@@ -79,5 +79,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/network-controller/package.json b/packages/network-controller/package.json
index 06e583d125a..0f49b45712f 100644
--- a/packages/network-controller/package.json
+++ b/packages/network-controller/package.json
@@ -103,5 +103,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/network-enablement-controller/package.json b/packages/network-enablement-controller/package.json
index 085e29a027a..9a372710665 100644
--- a/packages/network-enablement-controller/package.json
+++ b/packages/network-enablement-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/notification-services-controller/package.json b/packages/notification-services-controller/package.json
index 40be135c49d..9f0c7c8aff6 100644
--- a/packages/notification-services-controller/package.json
+++ b/packages/notification-services-controller/package.json
@@ -144,5 +144,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/passkey-controller/package.json b/packages/passkey-controller/package.json
index ce49749442e..2fa860cf4f6 100644
--- a/packages/passkey-controller/package.json
+++ b/packages/passkey-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/permission-controller/package.json b/packages/permission-controller/package.json
index b384b3b07d0..3172f846376 100644
--- a/packages/permission-controller/package.json
+++ b/packages/permission-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/permission-log-controller/package.json b/packages/permission-log-controller/package.json
index d214acb37cc..006ec7e9799 100644
--- a/packages/permission-log-controller/package.json
+++ b/packages/permission-log-controller/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/perps-controller/package.json b/packages/perps-controller/package.json
index d2e099144de..c217f8a4645 100644
--- a/packages/perps-controller/package.json
+++ b/packages/perps-controller/package.json
@@ -137,5 +137,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/phishing-controller/package.json b/packages/phishing-controller/package.json
index 179d6998abb..58084d22b78 100644
--- a/packages/phishing-controller/package.json
+++ b/packages/phishing-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/platform-api-docs/package.json b/packages/platform-api-docs/package.json
index cc4fd9803b8..beb8af46367 100644
--- a/packages/platform-api-docs/package.json
+++ b/packages/platform-api-docs/package.json
@@ -73,5 +73,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/polling-controller/package.json b/packages/polling-controller/package.json
index b010ea97ea0..60294cb133f 100644
--- a/packages/polling-controller/package.json
+++ b/packages/polling-controller/package.json
@@ -74,5 +74,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/preferences-controller/package.json b/packages/preferences-controller/package.json
index 44d33a4df4a..ad5b8c1a074 100644
--- a/packages/preferences-controller/package.json
+++ b/packages/preferences-controller/package.json
@@ -73,5 +73,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/profile-metrics-controller/package.json b/packages/profile-metrics-controller/package.json
index 8f15198ad1a..1922dbc5f32 100644
--- a/packages/profile-metrics-controller/package.json
+++ b/packages/profile-metrics-controller/package.json
@@ -87,5 +87,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/profile-sync-controller/package.json b/packages/profile-sync-controller/package.json
index 0a405f1d9ac..a65408043ea 100644
--- a/packages/profile-sync-controller/package.json
+++ b/packages/profile-sync-controller/package.json
@@ -153,5 +153,8 @@
   },
   "lavamoat": {
     "allowScripts": {}
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/ramps-controller/package.json b/packages/ramps-controller/package.json
index 36b5fafa5e8..7591ba3891b 100644
--- a/packages/ramps-controller/package.json
+++ b/packages/ramps-controller/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/rate-limit-controller/package.json b/packages/rate-limit-controller/package.json
index 1111813c2ff..edab202f8a6 100644
--- a/packages/rate-limit-controller/package.json
+++ b/packages/rate-limit-controller/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/react-data-query/package.json b/packages/react-data-query/package.json
index d2a82655657..fcb02e07d23 100644
--- a/packages/react-data-query/package.json
+++ b/packages/react-data-query/package.json
@@ -91,5 +91,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/remote-feature-flag-controller/package.json b/packages/remote-feature-flag-controller/package.json
index 45f7027f96a..9c556b55748 100644
--- a/packages/remote-feature-flag-controller/package.json
+++ b/packages/remote-feature-flag-controller/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/sample-controllers/package.json b/packages/sample-controllers/package.json
index 7648669388f..9de4a274f3f 100644
--- a/packages/sample-controllers/package.json
+++ b/packages/sample-controllers/package.json
@@ -79,5 +79,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/seedless-onboarding-controller/package.json b/packages/seedless-onboarding-controller/package.json
index 39cb62f54d3..1d528602dfb 100644
--- a/packages/seedless-onboarding-controller/package.json
+++ b/packages/seedless-onboarding-controller/package.json
@@ -95,5 +95,8 @@
       "@metamask/keyring-controller>ethereumjs-wallet>ethereum-cryptography>keccak": false,
       "@metamask/keyring-controller>ethereumjs-wallet>ethereum-cryptography>secp256k1": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/selected-network-controller/package.json b/packages/selected-network-controller/package.json
index 1f2aabecbc1..432e248ed0d 100644
--- a/packages/selected-network-controller/package.json
+++ b/packages/selected-network-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/sentinel-api-service/package.json b/packages/sentinel-api-service/package.json
index e4abdc24c33..a2c6d3e12b7 100644
--- a/packages/sentinel-api-service/package.json
+++ b/packages/sentinel-api-service/package.json
@@ -77,5 +77,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/shield-controller/package.json b/packages/shield-controller/package.json
index 8b54200b82b..2dc13c72ffc 100644
--- a/packages/shield-controller/package.json
+++ b/packages/shield-controller/package.json
@@ -90,5 +90,8 @@
     "allowScripts": {
       "@lavamoat/allow-scripts>@lavamoat/preinstall-always-fail": false
     }
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/signature-controller/package.json b/packages/signature-controller/package.json
index c584bdcf047..53d658dc991 100644
--- a/packages/signature-controller/package.json
+++ b/packages/signature-controller/package.json
@@ -84,5 +84,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/smart-transactions-controller/package.json b/packages/smart-transactions-controller/package.json
index 4bc1431f084..349a2f70316 100644
--- a/packages/smart-transactions-controller/package.json
+++ b/packages/smart-transactions-controller/package.json
@@ -90,5 +90,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/snap-account-service/package.json b/packages/snap-account-service/package.json
index b911eeb979a..f7427288b42 100644
--- a/packages/snap-account-service/package.json
+++ b/packages/snap-account-service/package.json
@@ -82,5 +82,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/social-controllers/package.json b/packages/social-controllers/package.json
index 0370ed36a3c..3a6b036c3e2 100644
--- a/packages/social-controllers/package.json
+++ b/packages/social-controllers/package.json
@@ -76,5 +76,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/solana-test-validator-up/package.json b/packages/solana-test-validator-up/package.json
index a485ba0c6d0..a433a4d4950 100644
--- a/packages/solana-test-validator-up/package.json
+++ b/packages/solana-test-validator-up/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/stellar-quickstart-up/package.json b/packages/stellar-quickstart-up/package.json
index 951440b417e..8cc216837ae 100644
--- a/packages/stellar-quickstart-up/package.json
+++ b/packages/stellar-quickstart-up/package.json
@@ -68,5 +68,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/storage-service/package.json b/packages/storage-service/package.json
index c858a8116f5..219b2a5858e 100644
--- a/packages/storage-service/package.json
+++ b/packages/storage-service/package.json
@@ -72,5 +72,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/subscription-controller/package.json b/packages/subscription-controller/package.json
index 1bacb93b343..73a232257b0 100644
--- a/packages/subscription-controller/package.json
+++ b/packages/subscription-controller/package.json
@@ -81,5 +81,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/transaction-controller/package.json b/packages/transaction-controller/package.json
index a8b85ca3d31..a9a40d9f3c9 100644
--- a/packages/transaction-controller/package.json
+++ b/packages/transaction-controller/package.json
@@ -112,5 +112,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/transaction-pay-controller/package.json b/packages/transaction-pay-controller/package.json
index 5c1c177926a..f0e02bbc9d3 100644
--- a/packages/transaction-pay-controller/package.json
+++ b/packages/transaction-pay-controller/package.json
@@ -92,5 +92,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/user-operation-controller/package.json b/packages/user-operation-controller/package.json
index a01b565d4d8..90573fc7365 100644
--- a/packages/user-operation-controller/package.json
+++ b/packages/user-operation-controller/package.json
@@ -92,5 +92,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/wallet-cli/package.json b/packages/wallet-cli/package.json
index ddc03891220..b14530f3637 100644
--- a/packages/wallet-cli/package.json
+++ b/packages/wallet-cli/package.json
@@ -85,5 +85,8 @@
   },
   "engines": {
     "node": ">=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/wallet-framework-docs/package.json b/packages/wallet-framework-docs/package.json
index de22720ca99..0686395c9e9 100644
--- a/packages/wallet-framework-docs/package.json
+++ b/packages/wallet-framework-docs/package.json
@@ -68,5 +68,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/packages/wallet/package.json b/packages/wallet/package.json
index a47b14f41d8..30edf6e433c 100644
--- a/packages/wallet/package.json
+++ b/packages/wallet/package.json
@@ -91,5 +91,8 @@
   },
   "engines": {
     "node": "^18.18 || >=20"
+  },
+  "scriptsConfig": {
+    "#default": "lavamoat/scripts.strict.json"
   }
 }
diff --git a/yarn.config.cjs b/yarn.config.cjs
index 2b55c2fd360..9e9e0472836 100644
--- a/yarn.config.cjs
+++ b/yarn.config.cjs
@@ -291,6 +291,12 @@ module.exports = defineConfig({
 
         await expectCodeowner(workspace, workspaceBasename);
       }
+
+      expectWorkspaceField(
+        workspace,
+        'scriptsConfig.#default',
+        'lavamoat/scripts.strict.json',
+      );
     }
 
     // All version ranges in `dependencies` and `devDependencies` for the same