GitHub Trending: Last week — Sniffnet, Trivy, FunASR, PowerToys, Astro

Two security tools in the top three. One of them just survived a supply-chain attack. The other just shipped its most-requested feature. That is this week's story.

GyulyVGC/sniffnet — the network monitor that replaced GlassWire

+1,197 stars this week · 39k total · Rust

Sniffnet is a cross-platform network monitor built in Rust using the iced GUI library. It shows live traffic per connection with geolocation, protocol detection, and customizable alerts — without requiring any expertise to operate. The pitch is simple: Wireshark for people who don't want to read Wireshark documentation.

Version 1.5, released in April 2026, added per-application traffic visibility — the single most-requested feature since the project launched. Users can now see which program is consuming bandwidth, favorite specific apps, and receive alerts when a flagged application begins generating traffic. IP blacklist imports also arrived in this version.

HN has given sniffnet two warm receptions over the years — 288 points in May 2023 and 256 points in February 2025 — and both threads filled with practitioners comparing it favorably to GlassWire's paid model. The French developer community on Bluesky was notably enthusiastic this week:

"Vous avez du trafic réseau bizarre et pas envie de vous battre avec Wireshark ? Sniffnet est une GUI cross-platform en Rust, avec géolocalisation et détection de trafic suspect, accessible sans expertise particulière." — camilleroux.com on Bluesky

Windows Central published a review calling it their "new go-to app for network monitoring" that "does everything I want and more." The project is a single developer's work — Giuliano Bellini (GyulyVGC) — accepted into GitHub's Accelerator Program in 2023 and still maintained solo. The community translation issue has contributions in dozens of languages.

What the +1,197 weekly stars reflect: the v1.5 feature drop, the Windows Central write-up, and renewed Bluesky traction. No hype cycle, no viral tweet. A tool doing its job better.

aquasecurity/trivy — the scanner that became the attack surface

+638 stars this week · 36k total · Go

Trivy scans containers, Kubernetes clusters, filesystems, Git repositories, cloud configurations, and infrastructure-as-code for vulnerabilities, misconfigurations, secrets, and SBOM components. One binary, one trivy image nginx command. For three months it has also been known as the project that was itself successfully supply-chain attacked.

On March 19, 2026, Aqua Security disclosed that a threat actor identified as TeamPCP had compromised Trivy's GitHub Actions pipeline. The attack wasn't a zero-day: attackers exploited a prior incident that wasn't fully remediated, retaining access through incomplete credential rotation. They then force-pushed malicious commits onto existing version tags in the trivy-action and setup-trivy repositories — meaning automated CI/CD pipelines that pinned to a tag, not a SHA, silently pulled compromised code. The payload included credential theft, tag poisoning, binary tampering, and a self-propagating worm that spread to 47 npm packages. CrowdStrike, Wiz, Microsoft, and Palo Alto Networks all published post-mortems.

An HN commenter captured the reaction bluntly:

"Pretty ironic that the security tool is insecure" — RS-232 on Hacker News

Another pointed to the structural lesson:

"Don't forget to pin your GitHub Actions to SHAs instead of tags, that may or may not be immutable!" — AdrienPoupa on Hacker News

The incident appears to have accelerated awareness of Trivy rather than damaged it. The tool was already in wide production use; the breach put its name in every security team's post-mortem agenda. Aqua released remediation guidance, rotated credentials, and audited the pipeline. The repo is actively maintained — last push two days ago, 244 open issues, steady contributor activity.

The 638 weekly stars arrive three months post-incident. Security teams finishing their scanner evaluations after reading the post-mortems are landing on Trivy anyway.

modelscope/FunASR — Whisper's industrial challenger with 170x speed

+632 stars this week · 17.9k total · Python

FunASR is Alibaba DAMO Academy's speech recognition toolkit, positioned as a production alternative to Whisper. The core claim: 170x realtime on GPU, with the smaller SenseVoice model hitting competitive speeds on CPU too. It bundles speaker diarization, emotion detection, voice activity detection, and streaming behind an OpenAI-compatible API you can self-host.

May 2026 brought a significant update: Qwen3-ASR (52 languages, automatic language detection) and GLM-ASR-Nano (dialect support) joined the model zoo, plus an MCP server for AI agent integration. The toolkit now operates as a drop-in replacement for Whisper API calls — developers migrating agentic pipelines from OpenAI's hosted transcription can swap the endpoint without changing calling code.

There is no HN thread for FunASR. The GitHub issue tracker is active but almost entirely in Chinese — the primary community is Chinese-language developers building production transcription systems. The +632 stars this week likely reflects international discovery, as the MCP server announcement gave it a new framing: not just a Whisper alternative, but speech recognition as a tool-call endpoint.

microsoft/PowerToys and withastro/astro

PowerToys (+441 stars, 134k total) is Microsoft's mature Windows utilities suite — FancyZones window manager, Command Palette, Text Extractor, and 20+ other tools. Version 0.91, released in May 2026, overhauled Command Palette performance and added low-level keyboard hook support, enabling shortcuts like Win+Space or Win+R as activation keys. Bluesky saw a burst of posts after the v0.91 release from Windows developers who use it daily.

withastro/astro (+264 stars, 60k total) rounds out the list. The content-site web framework is under active development — pushed today — with current community attention on CSP hash handling and Cloudflare adapter compatibility. Steady growth, no catalyzing event this week.

The lesson in the post-mortems

This trending period lands a concrete infrastructure rule across the industry: pin GitHub Actions to commit SHAs, not tag names. Tags are mutable. A tag named v0.28.0 can point to a different commit tomorrow. The Trivy attack worked precisely because pipelines trusted a label, not a hash. That lesson appeared in post-mortems from CrowdStrike, Microsoft, Wiz, and Palo Alto — and it brought more attention to Trivy than any release announcement would have.

The broader pattern: privacy and security tooling trending together is not a coincidence. Sniffnet shows you what your own machine is doing. Trivy shows you what your own containers contain. Both are defensive visibility tools. The week's list, underneath the variety of languages and project types, is developers equipping themselves to see inside their own systems.