对手图谱

MalwareGraph dependency security notice

On 2026-08-08, development builds exposed a high-severity denial-of-service advisory in nanoid (GHSA-2v37-7h3g-55p8) and an affected PostCSS pin (GHSA-fxqj-rqcc-2cmp). Pull request #30, included in v7, updates nanoid to 3.3.18 and PostCSS to 8.5.26 while retaining npm audit --audit-level=high as a blocking image-build check.

Older source Dockerfiles resolve MalwareGraph from a moving upstream branch, so tag history alone cannot prove the dependency contents of a locally rebuilt image. Current-source operators should pull the release commit, rebuild MalwareGraph without cache, and retain the successful audit output:

git pull --ff-only origin main
docker compose build --no-cache malwaregraph
docker compose up -d malwaregraph

The client now uses React Router 7, and the reviewed lockfile passes the required npm audit. Treat that as point-in-time release evidence and repeat the audit for every candidate; see Security Policy.

Quick Start

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env

Edit .env and set strong local secrets. AI features are optional for the base platform. To use them, configure an approved local OpenAI-compatible endpoint or an operator-approved cloud provider as described in the relevant guide.

docker compose config --quiet
docker compose pull
docker compose up -d --build
./scripts/selftest.sh

This checkout is a source-build installation. Its custom adversarygraph-*:local-scan images are built locally; docker compose pull only refreshes pinned third-party runtime images and intentionally skips those build targets. Do not replace the custom image variables with mutable latest tags. A prebuilt production deployment from current-development source requires all eight immutable image digests from the exact release's adversarygraph-images.env attachment; the historical v6.0.0 release does not contain that complete artifact set. The eighth family is the isolated scanner MCP image. Use a manifest only after the matching tag workflow publishes and verifies that complete artifact set. The self-test waits up to fifteen minutes for first-boot ATT&CK/ATLAS reference ingestion; override this with SELFTEST_TIMEOUT when operating across a slower network.

Open:

• Frontend: http://localhost:3000
• API liveness: http://localhost:3000/api/health
• API readiness: http://localhost:3000/api/ready
• API docs: http://localhost:3000/docs

The default Compose deployment binds the public UI and reference docs to localhost and keeps the API, Redis, malware-analysis service, and lab fixtures on the internal Compose network. Local configuration is stored in .env; the default persistent database is ${ADVERSARYGRAPH_DB_DIR:-./data/postgres}. See local storage and permissions before deleting data directories or Docker volumes.