GitHub Trending: Last week — PowerToys, FunASR, Trivy, Astro, Fastify
A vulnerability scanner whose entire job is catching compromised code spent March being turned into the compromise. Months later it is one of the fastest climbers on GitHub's weekly board — which says more about how trending works than about the tool.
Last week's board: PowerToys, Microsoft's Windows utility belt; FunASR, an Alibaba speech-recognition toolkit pitched as a Whisper replacement; Trivy, a container vulnerability scanner; and two web frameworks, Astro and Fastify.
Not one new viral repo among them. Every project is years old and carries between 17k and 135k stars. The outlier is Trivy, climbing again only weeks after attackers hijacked its release pipeline and turned the scanner itself into a credential stealer running inside thousands of CI jobs.
GitHub Trending usually reads like a hype ticker: a fresh AI-agent framework, a three-week-old repo with 8,000 stars, a README full of emoji. Last week it read like a list of things teams already run in production.
| Repo | What it does | This week |
|---|---|---|
| microsoft/PowerToys | Windows power-user utility belt | +1,042 |
| modelscope/FunASR | Speech recognition, pitched as a Whisper alternative | +605 |
| aquasecurity/trivy | Vulnerability, secret and SBOM scanner | +378 |
| withastro/astro | Web framework for content-driven sites | +279 |
| fastify/fastify | Low-overhead Node.js web framework | +85 |
Four of the five are mature infrastructure: 36k to 135k stars, years of commits, names you would recognise from a job posting. There is no AI-agent cluster, no overnight sensation. The lone machine-learning entry, FunASR, is a speech toolkit from Alibaba's ModelScope, not a chatbot wrapper. A trending week made of incumbents is itself the signal: developers were re-discovering load-bearing tools, not chasing the new thing. And the most interesting story on the board is what happens when one of those load-bearing tools gets attacked.
aquasecurity/trivy — the security scanner that became the payload
+378 stars this week · 36k total · Go
Trivy scans containers, Kubernetes clusters, git repos and cloud configs for known vulnerabilities. In March 2026 it became one. A threat actor calling itself TeamPCP force-pushed 76 of 77 version tags in the trivy-action GitHub Action, redirecting trusted references to malicious commits that read the CI runner's process memory and exfiltrated every secret they found. Within a day the stolen npm tokens were feeding CanisterWorm, a self-spreading worm that infected 47 npm packages and, per the post-mortems, used an Internet Computer canister as its command-and-control dead drop.
The detail that stuck with practitioners was not the worm but the repeat. Aqua had disclosed an earlier incident on March 1 and rotated credentials; the rotation missed some, and the same actor walked back in on March 19.
"This attack seems predicated on a prior security incident where they failed to successfully remediate and contain the damage. Trivy should've undertaken a full reassessment of risks and clearly isolated credentials. This did not happen, and the second compromise followed." — a reader citing the socket.dev breakdown
The Hacker News thread landed on the obvious, bitter line:
"Pretty ironic that the security tool is insecure." — a commenter on the advisory thread
The practical takeaway in the same thread was sharper than the irony: stop trusting mutable tags. "Don't forget to pin your GitHub Actions to SHAs instead of tags, that may or may not be immutable," one reader noted. That a scanner with 36k stars and a Microsoft Security advisory written about it is back on the trending board months later is the strange part — the star count tracks attention, and a public near-disaster is attention.
modelscope/FunASR — trending into a silence
+605 stars this week · 18k total · Python
FunASR is the week's only AI repo, and on paper it earns the attention: 50+ languages, speaker diarization, emotion detection, streaming, and an OpenAI-compatible API plus an MCP server bolted on. Its own topic tags include whisper-alternative, which is the entire pitch: a self-hostable transcription stack for teams who would rather not send audio to OpenAI.
What is missing is any conversation about it. Searching Hacker News for FunASR returns zero submissions; the Bluesky mentions are bare link-drops, one of them a bot announcing that someone starred the repo. A 600-star week with no English-language discussion is not proof of anything, but it is a contrast worth naming: the four Western tools on this list each have years of threads arguing about them, and the Alibaba speech model is trending in a vacuum. Capability is travelling faster than community here.
withastro/astro — and the ask baked into the description
+279 stars this week · 60k total · TypeScript
Astro is a genuinely well-liked framework for content sites, with an islands architecture that ships zero JavaScript by default. It is also the only repo on the board whose GitHub description ends with a sales pitch: "The web framework for content-driven websites. ⭐️ Star to support our work!" Trending is supposed to measure organic interest; Astro simply asks for the input directly, in the one line every visitor reads. No accusation needed; it is right there in the metadata, and it works.
The project's strength is its maintainers' visible presence. Astro's docs lead keeps fielding issues in public: "We have an open issue and are tracking this, someone will be on it first thing tomorrow." That kind of responsiveness turns a star into a return visit.
fastify/fastify — the quiet one going web-standard
+85 stars this week · 36k total · JavaScript
Fastify is the smallest mover on the list and the most telling inclusion. There is a six-year-old Hacker News thread literally titled "Fastify has 13k stars on GitHub, but no traction in HN. Why?". The answer, then and now: boring reliability does not generate threads.
"I originally chose Fastify over Express ~2 years ago, due to benchmarks, and it's been running stable in production since then. It's great software." — a developer who made the switch
What ties Fastify to Astro is direction, not size: both are quietly rebuilding on web standards. Fastify maintainer James Sumners replaced the framework's bespoke header parsing with a spec-compliant parser, and a maintainer PR is adding Web Standard API routes. The Node ecosystem's most-used pieces are converging on the platform instead of inventing around it. That is a slow story, which is exactly why it never trends on its own.
microsoft/PowerToys — the steady king
+1,042 stars this week · 135k total · C
The week's biggest gainer is also its least surprising. PowerToys has been a Hacker News favourite since the 2019 FancyZones launch pulled 500 points, and it keeps shipping: the v0.91 release added a low-level keyboard hook for the Command Palette and the option to hide the tray icon, announced by a PowerToys PM to a few hundred likes. Nothing dramatic, just a 135k-star utility belt that still gets monthly releases. It anchors the list precisely because it never needs an angle.
What a boring trending week is actually telling you
Strip away the AI froth and GitHub Trending becomes a trust index: PowerToys, Astro and Fastify climb because people keep coming back to tools that have earned it. The catch is that Trivy was on exactly the same list of earned trust, and that trust is what TeamPCP spent. A high star count is not a safety rating; it is a measure of how many pipelines an attacker inherits if they get in. The most-starred security tool on the board this week is the proof.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
GitHub Trending: Today — PowerToys, freeCodeCamp, Stable Diffusion WebUI, HackTricks, Meshery
Trending is supposed to mean new. Today it means old: every repo on GitHub's daily list is a multi-year veteran, and the only one with actual news is PowerToys — a 7-year-old Windows utility kit that just shipped its 100th release.