3 stories
In today’s GitHub Trending: Immich manages self-hosted photos and video; Qlib supports quantitative ML research; Trivy scans containers, repositories, and cloud configurations.
Immich supplied the clear spike with 636 stars. The pattern is not a single new category; it is developers choosing more inspectable control points around data, compute, and operational risk.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
Last week's board: PowerToys, Microsoft's Windows utility belt; FunASR, an Alibaba speech-recognition toolkit pitched as a Whisper replacement; Trivy, a container vulnerability scanner; and two web frameworks, Astro and Fastify.
Not one new viral repo among them. Every project is years old and carries between 17k and 135k stars. The outlier is Trivy, climbing again only weeks after attackers hijacked its release pipeline and turned the scanner itself into a credential stealer running inside thousands of CI jobs.
This week: Sniffnet — cross-platform network monitor with per-app visibility; Trivy — vulnerability scanner (recently supply-chain attacked); FunASR — Alibaba speech recognition at 170x realtime; PowerToys — Windows utilities; Astro — content web framework.
The sharpest detail: Trivy's March 2026 compromise — attackers force-pushed malicious commits to its GitHub Action tags and spread a worm to 47 npm packages — appears to have boosted, not buried, its star count. Security incidents are now marketing.