对手图谱

MalwareGraph dependency security notice

On 2026-08-08, development builds exposed a high-severity denial-of-service advisory in nanoid (GHSA-2v37-7h3g-55p8) and an affected PostCSS pin (GHSA-fxqj-rqcc-2cmp). Pull request #30, included in v7, updates nanoid to 3.3.18 and PostCSS to 8.5.26 while retaining npm audit --audit-level=high as a blocking image-build check.

Older source Dockerfiles resolve MalwareGraph from a moving upstream branch, so tag history alone cannot prove the dependency contents of a locally rebuilt image. Current-source operators should pull the release commit, rebuild MalwareGraph without cache, and retain the successful audit output:

git pull --ff-only origin main
docker compose build --no-cache malwaregraph
docker compose up -d malwaregraph

The client now uses React Router 7, and the reviewed lockfile passes the required npm audit. Treat that as point-in-time release evidence and repeat the audit for every candidate; see Security Policy.

MalwareGraph dependency security notice

On 2026-08-08, current-development source builds began failing the MalwareGraph UI security gate after npm reported a high-severity denial-of- service issue in nanoid (GHSA-2v37-7h3g-55p8; affected versions before 3.3.17). The same lockfile patch also pinned a PostCSS version affected by GHSA-fxqj-rqcc-2cmp. Pull request #30 fixes the build by updating nanoid to 3.3.18 and PostCSS to 8.5.26 while retaining npm audit --audit-level=high as a blocking image-build check.

No published tag contains the faulty lockfile patch: it was introduced after the latest published v6.0.0 tag. However, the v4.0.0 through v6.0.0 source Dockerfiles resolve MalwareGraph from the moving upstream main branch, so rebuilding those tags can select dependency state that differs from the original release build. Existing image contents must be checked directly; tag history alone cannot prove whether a previously built image contains an affected package.

For current source installations, update main and rebuild the MalwareGraph image before starting the service:

git pull --ff-only origin main
docker compose build --no-cache malwaregraph
docker compose up -d malwaregraph

Confirm the build completes the high-severity npm audit and reports nanoid 3.3.18 and PostCSS 8.5.26. Two upstream moderate-severity React Router findings may still be reported; they are separate from this fixed high-severity build failure.

Quick Start

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env

Edit .env and set strong local secrets. AI features are optional for the base platform. To use them, configure an approved local OpenAI-compatible endpoint or an operator-approved cloud provider as described in the relevant guide.

docker compose config --quiet
docker compose pull
docker compose up -d --build
./scripts/selftest.sh

This checkout is a source-build installation. Its custom adversarygraph-*:local-scan images are built locally; docker compose pull only refreshes pinned third-party runtime images and intentionally skips those build targets. Do not replace the custom image variables with mutable latest tags. A prebuilt production deployment from current-development source requires all nine immutable image digests from the exact release's adversarygraph-images.env attachment; the historical v6.0.0 release does not contain that complete artifact set. The eighth family is the isolated scanner MCP image and the ninth is the deterministic PCAP analyzer. Use a manifest only after the matching tag workflow publishes and verifies that complete artifact set. The self-test waits up to fifteen minutes for first-boot ATT&CK/ATLAS reference ingestion; override this with SELFTEST_TIMEOUT when operating across a slower network.

Open:

• Frontend: http://localhost:3000
• API liveness: http://localhost:3000/api/health
• API readiness: http://localhost:3000/api/ready
• API docs: http://localhost:3000/docs

The default Compose deployment binds the public UI and reference docs to localhost and keeps the API, Redis, malware-analysis service, and lab fixtures on the internal Compose network. Local configuration is stored in .env; the default persistent database is ${ADVERSARYGRAPH_DB_DIR:-./data/postgres}. See local storage and permissions before deleting data directories or Docker volumes.