enableScripts: false in .yarnrc.yml https://yarnpkg.com/configuration/yarnrc#enableScripts

And then opt certain packages back in with dependenciesMeta in package.json https://yarnpkg.com/configuration/manifest#dependenciesMeta....