FunASR

Last week's board: PowerToys, Microsoft's Windows utility belt; FunASR, an Alibaba speech-recognition toolkit pitched as a Whisper replacement; Trivy, a container vulnerability scanner; and two web frameworks, Astro and Fastify.

Not one new viral repo among them. Every project is years old and carries between 17k and 135k stars. The outlier is Trivy, climbing again only weeks after attackers hijacked its release pipeline and turned the scanner itself into a credential stealer running inside thousands of CI jobs.

This month: build-your-own-x (514k-star programming curriculum), yt-dlp (video downloader forced to add a Deno dependency), bitwarden/server and bitwarden/clients (password manager appearing twice after a licensing scare), and NangoHQ/nango (AI integration platform from YC W23).

The list's throughline isn't AI hype — it's platform anxiety. YouTube tightened its defenses, Bitwarden briefly went proprietary (then reversed), and a Chinese lab shipped a Whisper alternative that claims 170x realtime speed. Developers starred the escape hatches.

This week: Sniffnet — cross-platform network monitor with per-app visibility; Trivy — vulnerability scanner (recently supply-chain attacked); FunASR — Alibaba speech recognition at 170x realtime; PowerToys — Windows utilities; Astro — content web framework.

The sharpest detail: Trivy's March 2026 compromise — attackers force-pushed malicious commits to its GitHub Action tags and spread a worm to 47 npm packages — appears to have boosted, not buried, its star count. Security incidents are now marketing.