GitHub Trending: Today — blackbird, hackingtool, qlib, ntfy, Awesome-CV

Today's GitHub Trending front page reads like a kit for doing things yourself that you'd normally pay someone else to do: run an investigation, run a pentest, run a hedge-fund quant desk, run your own alerting, build your own résumé. Here is the whole list before the read.

Two of the five are offensive tools — and nobody's arguing about them

Strip out the utilities and the shape is clear: blackbird and hackingtool, the two repos climbing fastest, are both recon-and-attack tooling. That is half the security half of the list. What they share is stranger than the category: neither has a Hacker News thread. Not a dead one — none. blackbird surfaces as Bluesky link-drops in Ukrainian and English; hackingtool moves through French security-Twitter posts that append a "legal use only" note. They are being reshared, not examined.

Look at the other three and the pattern holds. qlib has reached Hacker News three separate times and drawn zero comments across all three. Awesome-CV has a handful of low-vote Show HN posts from a decade ago. Exactly one repo on today's list has ever sustained a real practitioner conversation — ntfy — and that thread is from 2021. Everything on the front page today arrived by being shared. That is fine for a résumé template. It is a different thing for a tool that installs 185 attack utilities.

p1ngul1n0/blackbird — a username, and every door it opens

+55 stars today · 6.8k total · Python

This is investigator tooling — for OSINT analysts, SOC teams, and journalists mapping a target's digital footprint. Bellingcat lists it in their investigation toolkit, which is the closest thing this corner of software has to a credential.

Feed it a username or email and it checks more than 600 sites — it rides the WhatsMyName site database — then exports the hits as PDF or CSV. The --ai flag sends only the site names, not any personal data, to a free model that writes a behavioral summary of the target. That last part is what separates it from the older Sherlock: Sherlock checks ~400 sites and usernames only, while blackbird adds email lookups and heavier coverage of fringe platforms like Gab and Truth Social. The two return different results for the same handle, so investigators run both.

The discussion gap is the story here. A tool that resolves a stranger's online presence in one command has no thread where anyone weighs the false-positive rate or the ethics of the --ai profile — just link-drops and one Bluesky post where someone runs it next to a breach lookup on a real person. Reach without scrutiny is the norm for this repo, not an anomaly.

Z4nzu/hackingtool — 185 tools behind one menu, almost none of them its own

+69 stars today · 78k total · Python

The audience is the beginner: someone on Kali or Parrot who wants a single launcher instead of installing tools one at a time. The menu spans 185+ third-party utilities across 20 categories — anonymity, information gathering, wordlist generation, wireless, SQL injection, phishing, RATs, forensics — with install-status ticks and a batch-install option. It writes almost none of those tools. It orchestrates them, and its one-tap installer pulls each from its own upstream repo.

That installer is exactly what independent reviewers flag. One 2026 writeup puts the question in the title:

"A legit security tool or just another script-kiddie kit?" — SignalForges, reviewing it in April 2026

Undercode's teardown makes the concrete case: a batch installer that fetches code from 185 upstream projects is a supply-chain surface no one is auditing, and any one compromised repo runs on your machine. The repo hasn't shipped a commit since July 2024. So today's star wave is lifting a bundle that has been frozen for two years — the front page can't tell you that, but the empty commit graph can.

microsoft/qlib — Microsoft's quant lab, now with an agent that writes the strategies

+102 stars today · 46k total · Python

This one is for quant researchers and ML-in-finance engineers, not weekend traders. qlib is a full pipeline: a fast data server, 25+ models spanning LightGBM to Transformers to reinforcement-learning order execution, the Alpha158 and Alpha360 datasets, and a qrun command that runs the entire train-backtest-evaluate loop. The reason it's moving now is RD-Agent — specifically RD-Agent-Quant, a 2025 multi-agent LLM system that mines factors and tunes models on its own, an autonomous stand-in for the researcher.

And yet: three trips to Hacker News, zero comments total. A serious, Microsoft-backed, 46k-star platform is trending the exact same way the viral security tools are — passed around, never picked apart. When even the institutional tool on the list has no conversation, "trending" has stopped meaning "the community is talking about this."

binwiederhier/ntfy — a push notification is one curl away

+90 stars today · 31k total · Go

ntfy is for the homelab crowd and sysadmins who want a cron job or a monitor to ping their phone without an account or a subscription. POST a line of text to a topic URL and it lands as a push on Android, iOS, or the web. The server is a self-hostable Go binary on SQLite. The latest release added an in-memory ACL cache and fixed a case-insensitive access-control bug on SQLite that could have exposed restricted topics — a reminder that even a notification server you run yourself is security-sensitive.

It's also the only repo here with genuine practitioner history — though you have to go back to 2021 to find it. That Show HN ran 119 comments, most of them stress-testing where ntfy fit:

"what benefits do you think make the app shine against something like Gotify?" — a commenter in the 2021 Show HN thread

The answer the project settled on — no third party, publish from anything that speaks HTTP — is why it keeps resurfacing on the homelab wave five years later. The debate happened; it just didn't happen this week.

Rounding out the list, Awesome-CV is the quiet one: a LaTeX résumé-and-cover-letter template that reappears on Trending every hiring season with no drama attached.

What the number next to the repo won't tell you

Trending ranks by fresh stars, and a fresh star now costs a Bluesky repost as easily as an afternoon of actually using the thing. That's why a two-years-frozen attack bundle and a live, actively-patched server sit side by side on the same page, indistinguishable by the count beside them. The one signal that still separates them is the thread. ntfy has one; blackbird and hackingtool don't. For anyone deciding what to install tonight, that absence is worth more than any star delta — a tool no practitioner has argued about in public is a tool nobody has checked for you.