tierlist.tech
中EN

10.23 Today's Picks

391 new projects found today, 221 rated.

Created 2026-10-21 – 2026-10-23Fetched 598Filtered 50Rated 38

S · Look today

S

reylo

colinhacksRust

Imports .sql directly into TypeScript with full type inference and zero codegen, closing the type gap between ORMs and hand-written SQL. The author is the creator of Zod with built-in distribution, evidenced by 656 stars in two days. It could become the standard dependency for SQL type checking; the risk is that Kysely and pgtyped already hold the niche.

Import .sql files into TypeScript with full type inference and zero codegen.

#Databases#Code Quality#APIs

★656

A · Worth watching

A

php2shell-scanner

assetnotePython

A high-fidelity scanner for the two php2shell CVEs from the Assetnote team, whose detection logic is more credible than the flood of bandwagon PoCs. CVE hype plus vendor backing brought 287 stars in two days; it can drop straight into ASM or vuln-scanning product lines, making it the most commercializable, though demand will decay fast once official patches ship.

High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)

#App Security#Exploits#Network Security#CLI

★287

A

bambu-bar

rolottrSwift

Puts Bambu Lab printer progress, temperatures, and AMS spools into the macOS menu bar over the local network without cloud login. For desktop users running several machines, it works by entering IPs and stays appropriately scoped. The limit is it only serves the Bambu ecosystem, so OctoPrint users can't use it.

Native macOS menu bar app for Bambu Lab 3D printers. Live progress, time left, temperatures, AMS spools and errors, print controls, several printers and desktop widgets. Local network, no account or c…

#3D#Hardware#macOS

★63

A

This is a full exploit for the PHP session.upload_progress UAF (CVE-2026-109618) that needs no official-version changes, bypasses ASLR and reaches practical, directly working PoC level. Nearly a thousand stars in a day show security researchers grabbing a reproducible exploit; monetization means scanner, honeypot and red-team integration, with value dropping once the official patch lands.

A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.

#Exploits#App Security#Linux

★953

A

hatchzip

xevrionRust

It deletes already-extracted archive parts as it unpacks, so you only need space for the output file, supporting zip, 7z, tar and split volumes. Aimed at people with tight disks unpacking hundreds of GB, it saves more space than typical extractors. The catch: once sources are deleted, errors can't be retried, and maturity needs real testing.

Extract huge archives in place: the archive shrinks as your files hatch, so you only need room for the output. ZIP, 7z, tar, split archives.

#CLI#Performance#Backup

★13

A

limitbar

dancikSwift

A macOS menu bar app showing usage quotas for Claude Code, Codex, Gemini, and Grok, explicitly read-only on local state and never touching credentials. For AI coding users constantly hitting rate limits, it's a small tool you can install immediately, with restrained scope.

AI coding limits in the macOS menu bar — Claude Code, Codex, Gemini (Antigravity), Grok. Never touches your credentials.

#macOS#AI#CLI

★46

A

rekey

golbinPython

Re-signs an API key with one command and syncs updates to 1Password and references in templates, for developers who rotate keys often. Scope is restrained and the description honest, exactly the small and specific kind of tool; the limitation is it only covers the 1Password plus template path.

Reissue an API key with one command and update it everywhere it is used (1Password + templates)

#Secrets#CLI#Automation

★26

A

A detector for the newly disclosed PHP2Shell (CVE-2026-109618/109619) covering URL black-box, local device, and SSH paths, from an author with a track record in security tooling. It's directly usable for incident triage; the limitation is it only covers this one CVE.

Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.

#App Security#Network Security#CLI

★26

A

aidbg

A-newC++

A Windows x86/x64 command-line debugger built for AI calls, with JSONL output, an MCP server, anti-anti-debugging, snapshot rollback and PDB types. The feature list is concrete and well-scoped, filling a gap for automated reverse-engineering agents; the downside is barely a day of history, unverified stability, and x64dbg's command-line mode as the nearest comparison.

AI-first Windows x86/x64 command-line debugger | JSONL output, MCP server, anti-anti-debug (ScyllaHide-style), snapshot rollback, IAT rebuild, PDB types

#Debugging#AI Agents#MCP#Windows#Reverse Engineering

★29

A

CinderVM

keegan0521Rust

A deterministic bytecode VM for agent execution, with image verification, snapshots and hash-chain replay logs, aimed at infra developers building agent sandboxes and reproducible execution. The angle is novel but still early, and whether it handles real workloads is unverified; wasm sandbox approaches exist in a similar direction.

Deterministic bytecode VM for agent execution - verified images, snapshots and a hash-chained replay journal

#AI Agents#Debugging#Observability

★66

A

JoyOff

sthetixC

A Switch homebrew that returns original Joy-Con to factory low-power shipping mode and disconnects them, fixing battery drain and pairing confusion from long docked sessions. Clear goal and small codebase make it a clean little tool for homebrew users, though ordinary users won't need it.

A simple Nintendo Switch homebrew app that puts original Joy-Con controllers into shipment low-power mode and disconnects them.

#Hardware#Embedded#Games

★25

A

mcd-advisor

wenboxiaJavaScript

Uses McDonald's China official pricing data to find cheaper ways to order the same meal combo, packaged as a zero-dependency CLI plus MCP and Agent Skill. Small scope and honest description make it directly useful for regulars, but it's locked to China-region APIs and useless abroad.

Mai Advisor: keep the same cravings, use McDonald's official pricing to find a better way to buy this meal (McDonald's China MCP · Agent Skill · zero-dependency CLI)

#MCP#Agent Skills#CLI#Productivity

★19

A

custom-tv

berteottiJavaScript

A custom desktop for Samsung Tizen TVs: weather, scenery wallpapers that change with weather, app shortcuts, plus steps for taking over the Home key. People who hate TV ads and the stock launcher will like it; the limitation is Tizen-only, requiring developer mode sideloading.

A calm custom Home screen for Samsung Tizen TVs: weather, weather-matched landscapes and your apps, with guides to make it the Home button.

#Web Frontend#UI Design#Hardware

★72

A

speed.skk.moe

SukkaWTypeScript

Source code for Sukka's web speed-test site, letting you self-deploy a clean speed-test page. The author has a solid reputation in proxy and networking circles and the description is restrained; the limitation is that speed-test frontends are plentiful, making this more a personal site open-sourced than a general library.

The source code of the https://speed.skk.moe

#Performance#Web Frontend#Self-Hosted

★73

A

Looking-Ahead

TencentARCPython

A paper repository from Tencent ARC researching future-evolution modeling in autoregressive video generation, offering reference value for teams working on video generation. It has institutional backing and a restrained description; the limitation is that such repos often hold only a paper and a few scripts, so reproduction must wait for full code.

Looking Ahead: Modeling Future Evolution in Autoregressive Video Generation

#AI#Video#ML Research

★61

A

Turns prayer times, qibla direction, adhan reminders, and Quran radio into an Android TV home screen, with offline data for 74 cities as a solid detail, aimed at Muslim families in the living room. Scope is restrained and the description doesn't oversell; the downsides are sideload-only, limited Google TV/TCL compatibility, and while phone apps abound, TV versions are rare.

Afnon (أفنون): Android TV launcher and home screen for Muslims. Offline prayer times (74 cities), Qibla, adhan/azan, prayer reminders, Ramadan and Friday modes, 16 Quran radio stations and reciters. A…

#Android#Audio#UI Design

★13

A

voxcpm2-turkce-ses-tasarimi

alexturkeySwift

Brings VoxCPM2 voice design to local 4GB VRAM, with a Turkish interface and 7 preset voices, and honestly notes it modified audio.cpp. Useful reference for small-VRAM local TTS; the limitation is it's a single-language, single-model wrapper.

Turkish voice design with VoxCPM2 on a 4 GB GPU: describe a voice, pick a variant, read Turkish text. Patched audio.cpp, local UI, 7 synthetic voices.

#Speech#AI#GPU

★66

A

UltraSlim

linyusenzzKotlin

An Android tool for offline batch transcoding of JPEG/HEIC/AVIF/JXL while preserving Ultra HDR gain maps, for people processing photos on their phone without uploading to the cloud. Preserving gain maps is more careful than most transcoding apps; the limitation is transcoding only, with no editing.

Android offline photo transcoding tool: convert between JPEG / HEIC / AVIF / JXL, preserve Ultra HDR / ISO 21496-1 gain maps, supports batch and background conversion

#Android#Images#Performance

★15

A

Docker images for end-of-life PHP 7.4/8.0/8.1 with backported fixes for CVE-2026-109618/109619, for ops teams locked to old versions. It's practical and the description is restrained; the limitation is that it patches only one CVE and can't replace a real upgrade.

PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported

#App Security#DevOps#Self-Hosted

★39

A

naskah-id

nothinxPython

An AI skill for Indonesian academic writing that rewrites and proofreads per EYD V and KBBI norms, serving Indonesian researchers. Both language and scenario are specific, more targeted than general writing assistants; the limitation is Indonesian only, and effectiveness still needs real-text validation.

Skill agen AI untuk menulis dan menyunting karya ilmiah berbahasa Indonesia yang natural, baku (EYD V, KBBI), dan jujur.

#Agent Skills#Content Writing#LLMs

★75

A

synodeb

rylosShell

A hands-on record of installing Debian 13 on a Synology DS923+ with working NIC, drive bays, and fan, including the official installer over SSH. It genuinely saves time for the few wanting to escape black Synology. The limit is it only covers one model and reads more like notes than a general script.

Debian 13 on the Synology DS923+: every piece of hardware working, installed with the official Debian installer over SSH

#Linux#Hardware#Self-Hosted#Operating Systems

★15

A

confess

yesterdayfuturePython

Before AI-written code is committed, it makes you explain the change in your own words and blocks you if you can't. Aimed at people who code with AI but can't read the code, it's a clever angle. The limitation: the repo offers only a slogan, with no detail on how it blocks or which hook it uses.

Your AI wrote the code. You still have to explain it before it ships.

#Code Quality#AI#CLI

★27

That's today. The other tiers and the boards follow.

BHas a spark52
  • B Snapintosh An EL2 hypervisor on Snapdragon X2 Elite plus a custom Adreno Metal/IOGPU stack to run macOS, rare hardcore systems work whose 546 stars in a day show real demand for macOS on ARM. Monetization could be virtualization or cloud-Mac licensing, but Apple legal risk and long-tail driver compatibility loom. #macOS#Hardware#GPU#Reverse Engineering

    EL2 hypervisor and toolchain that boots macOS on the ASUS A16 (Snapdragon X2 Elite), with an Adreno Metal/IOGPU stack

    AcelogicPython★546

  • B Ztrust Detects dependency poisoning, typosquatting, leaked secrets and insecure GitHub Actions together, and uses Zcash bounties to reward independent researchers, adding an incentive layer to supply-chain security. Supply-chain attacks are frequent and SCA has a clear paid market; the risk is a suspicious 152 stars in 0.2 days, and Socket and Snyk already own this budget. #App Security#Secrets#DevOps#Crypto

    Zero-trust supply-chain security for open source: detects malicious & vulnerable dependencies, typosquats, leaked secrets and unsafe GitHub Actions — and pays independent researchers in shielded Zcash…

    SpectrmachinaPython★152

  • B 3d-model-anything Scans a room with iPhone LiDAR and reconstructs an editable Three.js scene, closing the loop from scan to edit to web viewing, more developer-friendly than scan apps that only export meshes. Its 470 stars in two days largely come from Wes Bos's teaching audience. Monetization could be real estate or renovation SaaS, but Polycam and Luma are already strong. #3D#iOS#Web Frontend

    Capture iPhone LiDAR and photos, reconstruct editable Three.js rooms, and explore them in a browser.

    wesbosSwift★470

  • B cftgwebproxy It uses Cloudflare Pages as the main body with a Worker only forwarding, bypassing the 1101 and 522 errors common when Workers directly reverse-proxy Telegram, plus automatic DNS resolution. For people needing stable Telegram Web access, the details are solid. Many CF reverse proxies exist; the difference is only this bypass structure. #Networking#Self-Hosted#Automation

    A Telegram Web Proxy solution based on Cloudflare Pages + Worker + automatic DNS resolution. The main program runs on Pages to avoid the 1101/522 errors easily triggered by direct Worker proxying; the…

    xinyitang3JavaScript★17

  • B Pulse A Windows desktop floating window showing battery power draw and runtime, CPU and GPU usage and power, network speed and real latency, built natively in C++/Direct2D with a very light mini mode. Lighter than installing full HWiNFO, it wins on integration and size, though it has no unique metrics. #Windows#Monitoring#Performance#Hardware

    Lightweight Windows desktop floating monitor: battery power draw and battery life, CPU/GPU/memory usage and power, network speed, real latency and disconnect alerts. Native C++ / Direct2D, mini mode u…

    yftx888C++★16

  • B OpenShelf A drag-and-drop waystation on macOS: pick up files, press a key, drop them on a dial to convert, edit, AirDrop or stash, all offline. The scope is restrained and the actions clear, filling a gap in Finder drag-and-drop; limits are macOS-only and direct competition with paid tools like Dropover. #macOS#Productivity#UI Design

    Free, open-source Mac utility: start dragging any file, tap a key, and drop it on a wheel to convert, edit, AirDrop or shelve it. Runs fully offline.

    Manan-SantokiSwift★48

  • B vesper Packages common iOS reverse-engineering operations — runtime checks, decryption, debugging, tweak development — into MCP tools and Agent skills so models can drive them directly, a currently rare combination. Worth trying for iOS security researchers; it depends on a jailbroken environment and is very early in maturity. #Reverse Engineering#iOS#MCP#AI Agents

    iOS reverse engineering platform: MCP tools and agent skills for runtime inspection, automation, decryption, debugging and tweak development

    WtrwxPython★22

  • B ya-station-root-shell A full reproduction of the chain from eMudhra CA misuse to MITM of Yandex Station config sync to obtaining a root shell, with a disclosure report and PoC, for IoT security researchers. The complete chain is a plus; but it targets a single device and is an exploit, so ordinary users have no use for it. #Reverse Engineering#Network Security#Exploits

    Full chain reproduction: eMudhra CA → MITM of Yandex Station Mini 2 config sync → root adbd → root shell. PoC scripts + disclosure report.

    miilvPython★38

  • B rcf-agent A Python analysis tool for railway wheel-rail rolling contact fatigue, crack growth, and wear, with Chinese-guided input and report output. A rare specialized tool for rail engineers with restrained scope, but the audience is very narrow and there are no validation cases or comparisons with existing software. #Science#Data Analysis#Automation

    RCF Agent: a portable Python tool for rail rolling contact fatigue, crack growth, wear and shakedown analysis with Chinese guided input and reports.

    wangkaiyoursPython★14

  • B ming-voice A complete local speech-to-speech assistant setup on AMD GPUs (WSL2 + ROCm) based on Ming-3.0-audio-tiny. Local voice stacks outside CUDA are genuinely scarce and valuable to AMD users; limits are tight coupling to one model and WSL2, with no third-party latency validation yet. #Speech#AI#GPU#Linux

    Low-latency local speech-to-speech voice assistant with Ming-3.0-audio-tiny on AMD Radeon GPUs (ROCm on WSL2)

    JMS1717Python★54

  • B rossark-motion-skill A Claude Code skill that turns SVG into 60fps animations and outputs React Native and SwiftUI code, tackling the high cost of motion implementation. The skill ecosystem is young, and 274 stars show developers are willing to try. Monetization could be a paid skill marketplace or design-tool plugin, but output quality is unstable and general coding agents could replace it. #Agent Skills#Animation#AI#Web Frontend

    Turn any SVG into a professional 60 fps animation. A Claude Code skill that brings anything drawn to life: live faces, full-body acting and whole scenes, in React Native and SwiftUI.

    rossark0Swift★274

  • B garmin-personal-mcp An MCP server built on Garmin's official Personal API that pipes sleep, HRV, Body Battery and activity data into clients like Claude. Concrete and practical, filling a gap in health data; the barrier is applying for your own Garmin API access, and several third-party scraping options already exist. #MCP#Health#APIs

    MCP server for Garmin Connect on Garmin's official Personal API: sleep, HRV, body battery, activities, and more from Claude or any MCP client

    Mason-LevyyPython★17

  • B AbliteratedOutTheBox A fork that builds abliteration directly into the llama.cpp inference pipeline, aimed at people running uncensored local models. It saves a step over post-hoc weight edits, but forking means compiling yourself and tracking upstream, and thin docs make it hard to use; similar uncensored weights also exist. #LLMs#ML Research#GPU

    llama.cpp fork that abliterates at inference

    heterodoxinC++★25

  • B polars-anta A technical indicators and factors library built on Polars, for quant analysts who don't want to pull in C extensions. Pushing TA calculations into Polars expressions is a pragmatic angle, but similar libraries abound, so whether 'zero C' is actually fast needs benchmarking. #Data Analysis#Fintech#Performance

    ANTA (Alpha & Numerical Technical Analysis): Ultra-fast, zero-C technical analysis and factor library for Polars.

    huuan26Python★17

  • B pi-cached-compaction A plugin letting Pi's context compression read the conversation prompt cache, with a cache expiry timer, for people building agents with Pi. The angle is specific and the description honest; but it only matters within the Pi ecosystem, so the audience is narrow. #LLMs#AI Agents#Performance

    Pi compaction that reads the conversation's prompt cache, with a cache-expiry timer

    nicobailonTypeScript★45

  • B agent-speed It monitors token output speed from Codex and Claude Code, detecting slowdowns and plotting TPS curves. Useful for people running agents daily who want to know if the model is slow or the prompt is broken. Usage tools like ccusage already exist; it only adds real-time rate, and C# limits the audience. #Observability#AI Agents#Performance#CLI

    Agent Speed — A lightweight, real-time token speed monitor for Codex and Claude Code. Track tokens per second (TPS), detect slowdowns, and monitor AI agent performance at a glance.

    zoefixC#★19

  • B omni2api It wraps any agent, script or even manual process in an OpenAI-compatible interface, implemented in Rust, under the idea that everything can be 2API. It saves effort for people needing a unified interface, and the naming and description are honest; but several such shims exist, streaming and concurrency need code review, and samples are still few. #APIs#LLMs#Automation

    Anything to API (万物皆可2API): put an AI agent, a script, or even yourself behind an OpenAI-compatible API

    Juwan-HwangRust★19

  • B hermes-labs-plugins An experimental set of Hermes Agent plugins released by Nous Research, explicitly marked unsupported and open for community adoption, with honest wording. But it is a grab bag of plugins that only benefits people already running Hermes; outsiders still won't know which plugin to start with. #AI Agents#Agent Skills#Plugins

    ⚗ Experimental Hermes Agent plugins built by Nous Research but not supported: community tier in the plugin catalog, up for adoption.

    NousResearchPython★80

  • B pdf-annotate In-browser PDF annotation: add text, highlights, stamps, handwriting, form filling, and page merging, all client-side with no file uploads, addressing a real need. But Stirling PDF and various pdf.js editors are already mature, it names no differentiator, and a random username with 66 stars in half a day is suspicious. #Documents#Web Frontend#Editors

    Edit PDFs in-browser: add text, highlights, stamps, freehand ink; fill forms, merge pages, export annotated PDFs.

    bwuxqdmgyeubHTML★66

  • B effect-email A TypeScript transactional email library for the Effect ecosystem, with typed messages, reliable delivery, and clear SMTP and HTTP gateway boundaries, cleanly named. Unfortunately the repo is only hours old with 13 stars and no usage evidence; and if you don't use Effect, it's irrelevant. #Email#APIs#SDKs

    Effect-native transactional email for TypeScript: typed messages, durable delivery, providers, policies, SMTP, HTTP gateway, and workflows.

    doeixdTypeScript★13

  • B ds2-nx Runs Xbox 360's Dead Space 2 on Switch via static recompilation, requiring you to supply the game yourself, which is an honest approach. It is one example of the recent 360 recompilation wave; technically interesting, but useless to anyone without a hacked Switch and a legitimate disc. #Game Porting#Games#Reverse Engineering

    Dead Space 2 (Xbox 360) running natively on the Nintendo Switch: build from source with your own copy of the game

    VasilkovNDC++★18

  • B cleanyourtv-WebOS A clean home screen replacement for rooted LG webOS TVs, with optional removal of LG ads and telemetry, for privacy-minded TV users. The scope is clear and the options restrained; the limitation is that rooting is required first, so the audience is narrow. #Privacy#UI Design#Automation

    A clean home screen for rooted LG webOS TVs, with an optional debloat of LG's ads and telemetry.

    lasharorHTML★32

  • B korkana-ime A Windows global IME: type Korean pronunciation on the keyboard to get Japanese kana, then press space to convert to kanji. The problem is extremely narrow but the solution is clean, filling a real gap for Korean speakers learning Japanese; limits are Windows-only and Korean-to-Japanese only, with IME stability still needing time to prove. #Windows#Productivity#Learning#Editors

    A Windows global IME that outputs Japanese when you type Hangul pronunciations. 하지메마시떼 → はじめまして, convert to kanji with Space.

    Liter4553Python★21

  • B ticket-tear A 3D paper-ticket interaction demo: Verlet paper bending and tearing, holographic GLSL foil, and code-synthesized tearing sounds. Creative front-end developers can find some reference, but it is a single-page demo rather than a reusable component, and "Built with Gemini 4 Argon" hints at one-shot generation. #3D#Web Frontend#Animation

    A 3D ticket you can bend, flip and tear off. Verlet paper physics, holographic GLSL foil and a rip sound made in code. Built with Gemini 4 Argon.

    Sam1983AingTypeScript★26

  • B ComfyUI-MiniMaxH3-Loop A ComfyUI extension for seamless looping video using loop fill and decode, with ControlNet repaint support. A ready-made building block for loop assets, but it depends on MiniMax H3, so the audience is narrow. #Video#AI#Plugins

    Seamless looping video with MiniMax H3 in ComfyUI: circular padding, loop decode, ControlNet restyling and loop-safe interpolation.

    pxl-pshrPython★15

  • B pulsar Turns a Yandex Station Midi/Lite 2 into a local Home Assistant voice satellite and Music Assistant player, bypassing the Yandex cloud. Useful for HA users who happen to own this hardware, but the audience is narrow and it demands considerable ESPHome tinkering. #IoT#Self-Hosted#Audio#home-assistant

    Yandex Station Midi / Lite 2 as a local voice satellite for Home Assistant (ESPHome Native API) and a Sendspin player for Music Assistant — without Yandex cloud

    Morvex885C++★17

  • B crashott-pc Statically recompiles Xbox 360's Crash of the Titans to Windows with DLSS/FSR, gamepad support and Portuguese localization, a finished showcase in the recompilation wave. You must supply the game image yourself, and the audience is limited to those wanting to revisit old games. #Game Porting#Games#Windows

    Crash of the Titans (Xbox 360) statically recompiled for Windows: DLSS/FSR, PC controls, PT-BR, subtitles, mods. Bring your own copy of the game.

    VitoMiguelFC++★14

  • B yandex-station-root Root and OTA control scripts for the Yandex Station Mini 2, aimed at tinkerers of that speaker. The scope is honest (only Mini 2 tested), but functionality is thin and the audience very narrow; a full end-to-end reproduction of the same goal would be more useful. #Reverse Engineering#Hardware#Embedded

    Root ADB and OTA controls for Yandex Stations, tested only on Mini 2

    hu553inPython★22

  • B Morph A small desktop tool for converting and editing files from a radial menu, running on Windows and Linux, fully local. The entry point is handier than a typical converter and the scope is restrained; the limitation is single-file operations only, with deeper editing left to other software. #Productivity#Automation#Windows

    Convert and edit files from a radial menu, on Windows and Linux. Everything runs on your computer.

    itsofficially-sreyashRust★15

  • B uDPRE Runs a self-dumped Brilliant Diamond/Shining Pearl natively on Windows after conversion, a homebrew port route rather than piracy distribution. Interesting for players wanting to run their own cartridge data locally, but the repo is very new and compatibility and whether extra keys are needed remain unclear. #Game Porting#Games#Reverse Engineering#Windows

    Play your own Pokemon Brilliant Diamond dump on native windows: convert it once, then play.

    u2-botPython★13

  • B maimen-order-manager It wraps McDonald's mini-program features like pending reviews, reward progress, order add-ons and lottery confirmations into MCP skills, with 99 tests and a clear unofficial disclaimer, showing more engineering rigor than peer contest entries. But the scenario is extremely narrow and relies on non-public APIs, so it works best as an example of writing agent skills. #MCP#AI Agents#Automation

    McDonald's MCP Skill: review to-do list, positive-review reward progress, invoice reimbursement threshold order padding, single-draw confirmation. 99 tests, unofficial product.

    BEN020406Python★54

  • B actual-php2shell A vibecoded PoC for the PHP2Shell vulnerability arguing against claims that it's unexploitable, with a candid tone. It has reference value for vulnerability verification, but more complete detection and exploitation tools already exist, so it reads more like an opinion piece with code. #Exploits#App Security#php2shell

    :robot: NO, There is an easy way to exploit this vulnerability! (vibecoded to prove a point)

    cookiengineerHTML★40

  • B ai-job-search-kr Translates MadsLorentzen's ai-job-search skill into Korean and adapts it to the Korean job market, a localization port. It saves some setup for Claude Code users seeking Korean jobs, but novelty is limited and value depends on the original; the author credits MIT source honestly, though the ceiling is low. #Jobs#Agent Skills#LLMs

    AI job search and application skill for the Korean job market (Claude Code / Codex). Korean version of MadsLorentzen/ai-job-search, MIT

    wing0828Python★31

  • B mcdub3-nx A project statically recompiling Midnight Club 3 to run natively on Switch, Linux and Mac, aimed at game preservation and recompilation fans. This route has only matured in the past couple of years and is worth a look; but you must supply the game assets, and completeness isn't stated. #Game Porting#Games#Reverse Engineering

    Midnight Club 3: DUB Edition, recompiled to run natively on the Nintendo Switch, Linux and Mac.

    laureladastraC★22

  • B RealMe A SIGGRAPH Asia 2026 paper repo on immersive volumetric video with minimal capture. From zju3dv, the topic and output are worth watching. But right now there's only a title and conference tag, no code or data, so it's empty for anyone wanting to act today; wait for the code release. #3D#Video#ML Research#Multimodal

    [SIGGRAPH Asia 2026] RealMe: Immersive Volumetric Video from Minimal Captures

    zju3dvLanguage unknown★14

  • B php2shell-patches A collection of scripts patching the session.upload_progress UAF in EOL PHP 5.6–8.1, aimed at ops still running old WordPress, OpenCart and HestiaCP. It is practical, but a dozen similar repos appeared in a day, so you must vet whether the patches are tested and trustworthy. #App Security#Linux#DevOps#wordpress

    php2shell (CVE-2026-109618/CVE-2026-109619) emergency patches for old PHP 5.6/7.x/8.0/8.1 — official + community backports, enhanced universal patch keeping file uploads & progress bars. For OpenCart,…

    Anton-BarinovShell★67

  • B ComfyUI-Moss-Image-Edit A ComfyUI node for image editing via text instructions plus up to four reference images, aimed at people with existing workflows. The description is one sentence with no model source, VRAM requirements or examples, making it hard to distinguish from existing multi-image editing nodes. #Image Generation#Images#Plugins#comfyui

    Edit images in ComfyUI with text instructions and up to four reference images.

    Chenkin-xPython★29

  • B Taiga-Launcher-for-Steam It brings Epic, GOG, Xbox and emulator games into the Steam library with covers, achievement popups and playtime tracking, aimed at Windows players with multi-platform libraries. The idea is not new, Steam ROM Manager does similar work, and the description is promotional without explaining implementation or compatibility. #Games#Open-Source Alternatives#Windows#steam

    Turn your entire game library into a native Steam experience. Emulator, PC, Epic, GOG, Xbox, and other store games appear in Steam just like real Steam titles with covers, full game pages, native achi…

    GabrielTaigaJavaScript★38

  • B mrf-shiftlab A pure front-end 3D sandbox of a recyclables sorting center, about 130 seconds per shift, letting you view equipment, tweak parameters, and replay a timeline without external models or textures, cleanly engineered. Its use is basically limited to demos and teaching, hard to reuse for other production lines. #3D#Animation#Web Frontend

    A 3D digital twin sandbox of a recyclables sorting center. One shift lasts about 130 seconds, with equipment inspection, parameter intervention, and timeline replay; runs purely in the frontend with n…

    agentthinkTypeScript★19

  • B gcp-free-vm-skill An agent skill pack that walks you through setting up GCP's free e2-micro, saving a few steps for people chasing free tiers. It's essentially a wrapper over official docs and gcloud commands, heavily affected by GCP policy changes, with many similar tutorials and nothing irreplaceable. #Agent Skills#DevOps#Automation

    A guided automated activation skill pack for GCP Always Free e2-micro (just log in + bind a card)

    free-dam-manShell★13

  • B atlas-context It provides AI agents with user-reviewed personal context via a read-only MCP, with sources labeled. The idea is sound and the description honest (self-described experimental alpha), but it's too early and the demo data is synthetic, so it would be hard to use even if installed now. #MCP#AI Agents#Privacy

    User-reviewed personal context for AI agents. Read-only MCP, synthetic demos and traceable sources. Experimental alpha.

    niulengxiaoPython★21

  • B kiln Describes low-poly or voxel 3D assets in a DSL and exports GLB, with previews and Blender rendering. Letting agents generate game art is a decent direction, but the author shipped three isomorphic repos in one day, looking more like splitting one thing for exposure, with no usage evidence yet. #Game Dev#3D#blender

    Low-poly and voxel 3D game assets as code: a DSL that exports GLB with lights, agent-readable previews, a live viewer and Blender renders, turntables and camera-move videos. Sibling of vex and chirp.

    uilianksTypeScript★15

  • B maimen-xinshi A toy that uses the McDonald's China MCP to turn a single worry into a meal order, then lets three strangers vote on it, as a zero-dependency single file that reads well as an MCP Skill example. But it is a joke demo with almost no practical use. #MCP#Agent Skills#AI

    McDonald's Mood: reads a single worry as a McDonald's meal, then lets three strangers decide whether to eat it. A Skill based on the McDonald's China MCP + a zero-dependency single-file demo page.

    Tom123223HTML★56

  • B chistytv Uses PowerShell to remove ads and improve YouTube playback on Yandex, Xiaomi, TCL and other TVs, working over Wi-Fi without root and with rollback. Practical for Russian-speaking TV users, but it depends on specific firmware versions and modifying vendor systems carries risk. #Automation#Streaming#Hardware

    TV without ads and YouTube without lag: Yandex TV, Salute TV, Xiaomi, TCL, Haier, Google TV — over Wi-Fi, no root, with rollback

    by-sonicPowerShell★13

  • B tv-home An Apple TV-style launcher for TCL Google TV with liquid glass, previews, control center, and search. It appeals to TV users tired of the stock launcher, but Projectivy and FLauncher are mature, and this only covers looks without install steps or compatible models. #Android#UI Design#Video

    An Apple TV-style home screen for TCL Google TVs: Liquid Glass, previews, Control Center, search, Cinema mode, weather notices

    tinulicaJava★29

  • B loom Writes PBR materials like noise, brick, and wood as code, outputting albedo, normal, and roughness maps. Useful for those needing batch material generation, but it launched the same day as the author's vex and kiln, and the for AI agents line looks like keyword-chasing. #Game Dev#Images#3D

    Seamless game textures and PBR materials as code for AI agents: noise, bricks, planks, weathering; albedo/normal/height/roughness/AO/ORM maps, lit previews and a live viewer.

    uilianksTypeScript★14

  • B syncnote-community A Flutter all-in-one workspace for notes, tasks, journals and cloud files, emphasizing MIT licensing and a bundled backend. It overlaps heavily with Anytype and Obsidian, and with no screenshots, sync protocol or data format, 68 stars in a day looks more like launch promotion than validation. #Productivity#Knowledge Base#Self-Hosted#Documents

    MIT-licensed Flutter workspace for notes, tasks, journals, cloud files and research. Bring your own services.

    Dr-xu193Dart★68

  • B agentshield Workload behavior learning and lateral movement alerting for K8s and AWS, adding approvable remediation suggestions on top of Cilium/Falco. But it doesn't say where data comes from (eBPF? audit logs?) or deployment prerequisites, so it currently reads more like a product teaser. #Network Security#Observability#DevOps

    Agentshield is open source defense for Kubernetes and AWS. It learns how your workloads really talk, flags lateral movement with evidence, and proposes fixes you approve.

    agentshield-devGo★25

  • B Foldman An Android local music player mimicking the Walkman interface, tailored for foldables like the Z Fold 8, and integrating YT Music and Apple Music. The aesthetic direction is clear but the audience is very narrow, and compliance and stability of third-party service integration are unaddressed. #Android#Audio#UI Design

    Walkman style audio player for Android, specifically the Z Fold 8 and other foldables. Support for local audio files, YT Music and Apple Music.

    deveshraiKotlin★20

  • B mission-plus A macOS tool positioned against the paid Mission Control Plus, adding window close, minimize and keyboard controls. The idea is clear, but 'smoother' is only a self-claim with no evidence yet, and such window tools are plentiful both built-in and from competitors. #macOS#Productivity#Open-Source Alternatives#mission-control-plus

    Mission Control Plus, but free and smoother. Close, minimize and keyboard-drive windows on macOS.

    j1mmy2hangSwift★15

  • B contextcraft A tool for compressing codebase context for LLMs, using AST plus PageRank ranking and trimming to a token budget. The direction is useful, but the description is packed with jargon, mature options like repomix already exist, and benchmark data is needed to be convincing. #LLMs#RAG#Performance

    AST-Aware, Personalized-PageRank-Ranked, Token-Budgeted Codebase Compressor for LLMs

    khanhtq29vnPython★20

  • B vex A DSL for 2D vector game assets that exports SVG, PNG sprites, and animation atlases, self-described as inspired by claude-pxl. Somewhat useful for procedural sprite generation, but it's the third isomorphic repo from the same author in a day and explicitly yet another one. #Game Dev#Images#Animation

    2D vector game art as code: a DSL that exports SVG/PNG sprites, animations and atlases, with a live viewer. Inspired by claude-pxl.

    uilianksTypeScript★16

COrdinary60
  • C opal It has coding agents continuously rewrite and optimize the optimizer itself during training, turning meta-optimization from papers into usable code, a novel angle for training-efficiency research. 158 stars show ML engineering interest, but it lacks benchmark comparisons and reproducible results. Monetization depends on training frameworks or cloud vendors, and PyTorch could absorb it natively. #AI Agents#ML Research#LLMs#Automation

    OPAL: a reactive optimizer. A coding agent rewrites the optimizer while your model trains.

    xingjian-baiPython★158

  • C php_uploadprogress_guard Provides extension-level mitigation for old PHP environments that cannot upgrade immediately, compatible with 5.6 through 8.5 plus cPanel and DirectAdmin panels, which is practical from an ops view. But it positions itself as a temporary patch that yields once official fixes land, so its value decays quickly with each PHP release and it is hard to build into a long-term product; security vendors' WAF rules are a stronger competitor. #App Security#Exploits#DevOps#Self-Hosted

    Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP …

    HOSTED-POWERC★111

  • C spacemapper A disk usage treemap tool for Linux, explicitly positioned against Windows' SpaceSniffer. The positioning is clear and the description honest, but baobab, ncdu and dust already fill this niche, so a new project needs a faster or better-looking interface to justify switching. #Linux#Open-Source Alternatives#Performance#spacesniffer

    Disk usage viewer for Linux that shows files and folders as a treemap, similar to SpaceSniffer

    Martin-iiRust★17

  • C Bastion An assessment tool for PHP patch verification, intrusion trace tracking and offline reporting, clearly riding the current PHP RCE wave. It bundles three things but the description has no command examples, making it hard to tell what evidence-driven actually means. #App Security#Linux#DevOps

    Evidence-based PHP security assessment: patch verification, intrusion tracing, and offline reports.

    BastionPHPGo★57

  • C php2shell-fixed Patch packages for end-of-life PHP versions on the BaoTa panel, bundling patched source plus one-click compile, replace and rollback scripts for a specific ops scenario. The approach is pragmatic, but it is part of this php2shell rush, so patch correctness needs independent verification. #App Security#Linux#DevOps

    PHP2Shell (CVE-2026-109618 / CVE-2026-109619) fix packages for end-of-life PHP versions (5.4 – 8.1) on BT Panel. The repo contains patched source packages and scripts that compile, replace, and roll b…

    QsnhShell★33

  • C plus-one Lets an AI companion watch web videos with you: it sees the screen, reads the current subtitles, and talks via danmaku comments. The idea is fun, but only a concept is given, with no word on where the model runs or latency, and desktop use requires a dedicated Chrome. #AI#Multimodal#Video

    Watch anything on the web together with your AI companion: they see the picture, read the subtitles up to now, and talk in danmaku. Desktop (dedicated Chrome) and iOS.

    corcordataJavaScript★18

  • C McShake A pixel-art slot machine built on the McDonald's MCP, with a nutrition ledger and order-combination calculator, an amusing MCP demo. It's more entertainment than utility, closer to a portfolio project; to learn MCP, the official examples and docs are better. #MCP#Games#AI

    A pixel-art slot machine driven by the official McDonald's MCP: nutrition ledger + order padding optimization + 1+1 Mix & Match

    gundamliJavaScript★35

  • C php2shell A complete RCE reproduction environment for the PHP session.upload_progress UAF, with a Docker range and one-click scripts, usable by both red and blue teams to verify patches. But a dozen repos on the same topic appeared in one day, and the vulnerability details and CVE authenticity still need checking. #Exploits#App Security#Network Security#Linux

    Remote HTTP-only RCE on PHP 8.4.26 + Apache prefork/mod_php (ASLR bypass via session.upload_progress UAF) — self-contained Docker lab, one-click exploit.py

    3em0Python★15

  • C glassos-tv A tvOS-style glass launcher for Android TV, Google TV and Fire TV aimed at users who want to replace bloated stock home screens. The idea is clear, but the repo is under a day old with no screenshots or install instructions, and mature alternatives like FLauncher already exist. #Android#UI Design#Open-Source Alternatives#tvos

    A calm, glassy home screen for Android TV, Google TV and Fire TV, inspired by tvOS

    AbhishekKaisarKotlin★15

  • C php2shell Turns this CVE into a research toolkit with version profiling, a lab environment, and heap calibration, aimed at authorized testing and more complete than a bare PoC. But a dozen repos appeared in this space within two days, 96 stars isn't standout, and willingness to pay for security research tools concentrates among vendors rather than individuals, so it's hard to build a standalone business. #Exploits#App Security#Network Security#Testing

    PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance f…

    devploitPython★96

  • C php-cve-2026-109618-109619-backports Backports two PHP core RCE fixes to unsupported 5.4 and 7.3, a real need. But the repo has only one-line description, no patch notes, tests, or upstream diff comparison, and PowerShell distribution raises reproducibility doubts. #App Security#Exploits#DevOps

    Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3

    vperettiPowerShell★30

  • C Dino-Crisis-Modern-Edition A fan remake of Dino Crisis for PS1 adding an over-the-shoulder view, modern controls and visuals, and QoL options for nostalgic players. The C-based remake also offers reference value for PS1 reverse engineers, but install steps and compatibility are unclear, marking it as a niche project. #Games#Game Porting#Reverse Engineering

    Fan mod of Dino Crisis (PS1). It brings a modern Resident evil Remakes like over-the-shoulder camera, updated controls, visual/gameplay improvements, and plenty of Quality of Life settings to customiz…

    RotmillC★35

  • C raccoon Aims to build a self-hosted Flutter runtime, covering protocol packages, host runtime, view components and a C++ runner all at once. The ambition is large, but it never explains how it differs from Flutter's official multi-platform approach, and at alpha stage it cannot be verified. #SDKs#Web Frontend#Build

    The Raccoon hosted Flutter runtime: the protocol package, the host-side runtime, the view widgets and the C++ runner, one repository, one tracker.

    SoFluffyOSDart★14

  • C bunkercoin A monorepo claiming to be a blockchain running on radio waves, a catchy concept, but with no technical explanation of how consensus, bandwidth, and latency constraints are solved, and no runnable node. For now it's more narrative than engineering. #Blockchain#Crypto#Networking

    BunkerCoin monorepo - the blockchain running on top of radio waves.

    bunkercoinorgRust★41

  • C clearstream A Windows IPTV player built on VLC, pitched as small and safe. The functionality is straightforward, but IPTV players are already plentiful, the 'safe' claim isn't elaborated, and there's little reason to switch. #Video#Windows#Privacy

    Clearstream: a small, safe IPTV player for Windows built on VLC

    killerwazPython★25

  • C mcd-saver-checkup Built on the McDonald's China MCP, it enumerates every purchase combination and recomputes price differences with calculate-price, applying agent skills to a concrete consumer decision like "where am I losing money"—a rare good example of MCP in practice. But it depends on a single brand's API that could be blocked anytime, and monetization room is small, making it more a demo sample for the skill ecosystem. #MCP#AI Agents#Productivity

    McDonald's Savings Checkup: it doesn't look at what you want to eat, it first looks at where you're already losing money. A price-difference audit Skill based on McDonald's China MCP — enumerate every…

    lklbar666Python★87

  • C php2shell-protection Blocks multipart POSTs and limits request bodies at the Apache layer as emergency mitigation, something ops can deploy immediately during a patch gap, with vendor Syhunt backing it. But such rules are essentially reimplemented WAF rules whose value drops to zero once patches ship, so it can't become a standalone product line. #App Security#Network Security#DevOps

    Emergency Apache mitigation and testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619), featuring multipart POST blocking, request-size limits, and additional hardening measures.

    syhuntPHP★93

  • C pokeheartgold-single-screen A build converting the pokeheartgold decompilation project to single-screen display for ssrecomp's single-screen recompilation. It is a real patch for the NDS Pokémon modding scene, but the audience is tiny and it depends on upstream, so usability is hard to judge from the repo alone. #Games#Game Porting#Reverse Engineering

    Single-screen decompilation build of Pokemon HeartGold/SoulSilver (pokeheartgold), the source for the ssrecomp single-screen recomp.

    ClickingMasterC★20

  • C Uni-SuperMimic A reproduction of the SuperMimic human full-body motion tracking work on UniLab, aimed at embodied AI and animation researchers. Reproduction has value, but the repo only names the target and gives no training configs, metrics or gaps versus the paper, making quality hard to judge. #ML Research#Robotics#3D

    SuperMimic-UniLab: An Independent reproduction of SuperMimic on UniLab for whole-body humanoid motion tracking.

    MotphysPython★31

  • C mctaste-lab An independent entry for the McDonald's MCP contest that runs a few rounds of either/or food questions to produce explainable, adjustable preference and exploration recommendations. The preference modeling is clearly explained, but the data and scenario are contest-defined, limiting real-world value and making it homogeneous with other McDonald's entries. #AI Agents#MCP#Data Analysis

    Mai Mai Preference Lab | A few rounds of choosing between two menu items generates explainable, adjustable preference and exploration recommendations. An independent entry in the McDonald's MCP creati…

    PlusF666Python★42

  • C proxy A simple web reverse proxy from Qbix meant to add an interception layer in front of known-vulnerable PHP codebases, aiming for a minimal WAF. But there is only a one-line description, with no word on rule sources, performance overhead or bypass risk, so it is hard to evaluate now. #App Security#Network Security#DevOps

    Simple web server proxy to protect PHP code bases from known vulnerabilities.

    QbixC★13

  • C pi-ampersand An AI collaborator that listens in on pi coding sessions and only chimes in when valuable, trying to fix the collaboration rhythm where agents only speak when called; the interaction design is novel. But it's deeply tied to one tool's ecosystem, 83 stars is small, and the main agent could absorb its abilities natively, limiting commercial room. #AI Agents#LLMs#CLI#Collaboration

    Ampersand, an AI collaborator, reads along in your pi session and speaks up only when it has something worth hearing

    y0usafTypeScript★83

  • C raccoon_simulator A companion emulator for the raccoon runtime that lets you preview in macOS/Linux editors. It depends on a new runtime not yet proven usable, so on its own it is an empty shell; unless you already follow raccoon, there is no reason to try it. #SDKs#Editors#macOS

    Run your Flutter app on Raccoon from the editor you already use, and see it in a simulator window. macOS and Linux. Alpha.

    SoFluffyOSDart★15

  • C mafdet Aims to have a small local model pre-read context while you type, and the "low-latency local speculation" direction is interesting. But it is only a slogan: no word on how it hooks into an IME or editor, what the latency is, or which model it uses, so it cannot be installed or tested. #AI#LLMs#Editors

    You type. It already knows. Local LLMs that read and think while you type.

    TheLastOxygenPython★24

  • C php2shell-Lab A Docker reproduction lab for some PHP RCE, with a Chinese write-up of the mechanics. It's acceptable as teaching material, but several labs and PoCs for the same CVE appeared this time, and it offers no unique perspective. #Exploits#App Security#Learning

    🐘 php2shell (CVE-2026-109618 / CVE-2026-109619) reproduction lab — session.upload_progress filename injection + LFI → RCE, one-click Docker launch, with Chinese write-up and PoC

    kuwooPython★22

  • C lean-electron-vue A desktop template using Electron, Vite, Vue 3 and TS. Another scaffold, it offers nothing new beyond 'no third-party plugins', and similar templates are a dime a dozen. #Web Frontend#Build#SDKs

    A lean Electron + Vite + Vue 3 + TS desktop app template with no third-party integration plugins

    mrcen3204097569-specTypeScript★35

  • C CofactVLA A paper repo on counterfactual intervention to de-confuse VLA models, with only a title-level description. The direction is embodied-AI frontier work and may help researchers in the field. But there's no code, data, or experiment details, so clicking in only shows an abstract. #ML Research#Robotics#AI

    CofactVLA: Deconfounding Vision-Language-Action Models via Counterfactual Intervention

    zhangy0822Python★15

  • C aqueli An all-in-one offline-encrypted personal organizer for Windows covering tasks, calendar, notes, habits and expenses. The direction is appealing, but it tries to do everything, looks little different from Notion or Obsidian with plugins, and never explains its encryption or data format. #Productivity#Windows#Privacy

    A private, all-in-one organiser for Windows. Tasks, calendar, notes, habits and budget, encrypted and entirely offline.

    Areemi-appTypeScript★16

  • C PustakaKu_Blogger-Templates A Blogger landing page template for Indonesian librarians, sincere in tone and genuinely solving a specific problem for a small group. But it's a static template rather than a tool, low on technical substance, with little for most readers to see. #Web Frontend#UI Design#Knowledge Base

    Bagi yang kesulitan memperoleh template landing page untuk perpustakaan, berikut saya persembahkan template sederhana yang dapat digunakan oleh Bapak/ibu/pustakawan. Semoga bermanfaat 🙌

    alpinjolalaLanguage unknown★37

  • C Scribely An OpenRouter chat frontend aggregating 500+ models, with Clerk login and a terminal-style interface. Another LLM wrapper, with the interface as its only differentiator, and open-source chat clients of this kind are already numerous. #LLMs#Web Frontend#UI Design

    AI chat app with unified access to 500+ LLMs via OpenRouter, Clerk auth and a terminal-style interface.

    jwuthri-cloudTypeScript★42

  • C t3l-android-headunit-revival A lightweight launcher and tinkering guide for the T3L Android head unit, aimed at owners of that specific unit. The content leans toward tutorials and a personal project, lacking reusable engineering value and with limited generality. #Android#Hardware#UI Design

    Reviving T3L Android car head units with a lightweight, AI-built launcher and practical guides to setup, customization, and optimization.

    nurfaizfoatPython★23

  • C php-safe An unofficial PHP fork claiming security hardening and several CVE patches. The idea is fine, but fork maintenance is costly and the description lists no patches, so credibility is weak. #App Security#Build#Linux

    An unofficial PHP fork with security enhancements and patches for numerous known CVEs.

    ptewalkC★14

  • C iOS27.0.1-SPTM-Research A research summary on iOS 27.0.1 SPTM aimed at iOS security researchers. But the repo is only note-style summary with no tools or reproducible steps, and the version number itself is suspicious, making it look more like a hype-chasing content repo. #iOS#Reverse Engineering#App Security

    Summary of the SPTM research on iOS 27.0.1, iPhone Air

    IvanIVGroznyPython★64

  • C php-eol-security Security-fixed PHP 7.4/8.0/8.1 builds recompiled with the official Windows build process, a stopgap for people still running EOL PHP on Windows. Practical but narrow, with patch contents and trustworthiness needing your own review, and several repos already chasing the same demand. #App Security#Windows#DevOps

    Unofficial Windows builds of end-of-life PHP versions (7.4, 8.0, 8.1) with security fixes, made with the official PHP Windows builder

    JamalofskiLanguage unknown★20

  • C KohakuGBC The author expresses graph-based captioning as a KIR program with a dataflow engine, conceptually interesting, and the author has credibility in the generative-model community. But the description is all invented terminology with no install steps or minimal example, so outsiders can barely tell what it does. #ML Research#Multimodal#Science

    Graph-Based Captioning as one KIR program on the Togeari dataflow machine, with its engines

    KohakuBlueleafPython★26

  • C macau-hidden-bites A Macau food recommendation agent using Thompson Sampling with weighted fusion for preference modeling, plus 5-fold cross-validation and bootstrap evaluation, more serious methodologically than most contest entries. But it is a contest assignment with simulated users and data, so real-world value is limited. #AI Agents#Data Analysis#Learning

    A Macau food recommendation Agent built on Thompson Sampling + StackedPareto weight fusion, with a full evaluation pipeline (5-fold CV, bootstrap CIs, stress tests) on 5,000 simulated users and 100k i…

    Lico124378Python★31

  • C biko3-ios A project porting some game to iOS using a libnx adaptation layer and MoltenVK. The description doesn't say which game or how complete it is, so ordinary readers can't evaluate it, and its usability isn't apparent for now. #Game Porting#iOS#Games

    Biko3 native iOS port with libnx adapters, MoltenVK and reproducible cloud IPA builds

    hyc1743Python★14

  • C OmniGrab A GUI for yt-dlp claiming support for downloading from over a thousand sites. The functionality is fine, but such GUIs are already plentiful, it offers no new approach, and being less than a day old it's hardly proven. #Downloaders#Video#UI Design

    A modern, open-source GUI for yt-dlp. Download video and audio from YouTube, TikTok, Instagram, and 1000+ sites in one click. No terminal, no ads.

    insistentsteHTML★15

  • C TARSphere It claims to be a full-stack framework for long-horizon embodied agents, covering physical and social environment evolution. Grand-sounding, but the repo has no runnable entry point, dependency docs, or examples; "full-stack framework" is itself a warning sign, and it's unclear what it delivers. #Robotics#AI Agents#ML Research

    A robot-oriented full-stack framework for long-horizon embodied agents in evolving physical and social environments.

    xuyicheng-zjuPython★14

  • C Treasure-Radar A radar mod for Helldivers 2 that marks all samples, medals and super credits on the map, essentially a wallhack that undermines multiplayer fairness. It is not technically hard and offers no transferable engineering value. #Game Cheats#Games#Reverse Engineering

    Helldivers 2 mod: a sonar radar with every sample, medal, Super Credit, Requisition Slip and supply around you, where your map opens.

    Th3chefPython★34

  • C emmy-hackathon-2026 A hackathon challenge repo that compiles a custom Kernel IR to PTX. It has practice value for compiler/GPU people, but it's event scaffolding, not a tool or library you can install and use. #GPU#Build#Benchmarks

    Emmy Hackathon 2026: write a compiler that turns Emmy's Kernel IR into PTX

    cloudrift-aiCuda★16

  • C cve-2026-109618-php2shell A PoC for a PHP RCE, aimed at vulnerability reproduction and defensive verification. The problem is that this same CVE already has lab environments and patch mirrors among these repos, and this is just the thinnest exploit script with no extra analysis, so its standalone value is limited. #Exploits#App Security#Reverse Engineering

    Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell

    godylockzPython★28

  • C Beat2Git A small tool syncing the currently playing Apple Music track to GitHub, aimed at people who want a lively profile. The idea is light, but many similar status-sync scripts exist, and the repo never says whether it is Actions or a local daemon, with no screenshots. #Social#Automation#Audio

    Share what you're listening to on Apple Music with the GitHub community

    Krusty84Python★25

  • C php7 Security backports of PHP 7.4 packaged for older Ubuntu/Debian, essentially a distro-style backport. A stopgap for ops stuck on EOL PHP, but several similar repos have appeared this week, so pick based on maintainer background rather than stars. #App Security#Linux#DevOps

    PHP 7.4 security-backport packages for older Ubuntu and Debian releases

    NiekShell★27

  • C roblox-account-switcher A Roblox multi-account switcher that imports and exports cookies to switch accounts and run multiple instances without logging in, with specific features but clearly against platform rules, and plaintext session credential handling is itself risky. Similar small tools have long existed in the community, and 71 stars in half a day is suspicious, with no reason to look now. #Games#Automation#Privacy

    Roblox account switcher: save unlimited accounts, one-click switch, auto cookie refresh, multi-instance launch, cookie importer/exporter

    ezosizcojoajHTML★71

  • C z-localization An open-source RoboMaster sentry localization project, for teams in the same competition. It's contest code lacking generality and documentation, so it's of little use to outsiders. #Robotics#Embedded#3D

    2026 Northeastern University T-DT Lab RoboMaster Super Competition sentry localization, open source

    moziheC++★20

  • C protein-design-interactive-slides An interactive slide deck on protein design, good as an intro demo for students or career-switchers. It's carefully made teaching material, but it's content, not a tool, and the knowledge is already in AlphaFold and ProteinMPNN docs and courses, so no usable increment for daily榜单 developers. #Learning#Biotech#Science#Presentations

    ramithuhJavaScript★39

  • C hyper-aero A Frutiger Aero/Y2K theme configuration for Hyprland, aimed at Arch desktop customization fans. It's a dotfiles share with a clear aesthetic, but it doesn't solve any new problem, and similar rice configs are everywhere. #Linux#UI Design#Terminal

    Frutiger Aero / Y2K rice for Hyprland 0.56+ (Lua config) on Arch Linux

    jotaperomQML★22

  • C Advanced-Bioinformatics A learning path from Linux, Python, and R to RNA-seq and Bioconductor, collecting tutorials and exercises. It saves beginners effort, but it's essentially a resource list of external links with no method or tool of its own, so treat it as a content repo. #Learning#Biotech#Science

    A free, hands-on bioinformatics roadmap from Linux, Python & R to RNA-seq, genomics, Bioconductor, and advanced transcriptomics. Curated English tutorials, YouTube playlists, practical exercises, and …

    talharaziqLanguage unknown★58

  • C DFRoot-Samsung A UI and diagnostics companion for a Samsung Galaxy S22+ root project, adding clearer report saving. But it never explains the root chain itself or which firmware applies, so it reads like a personal companion tool of limited value to non-project users. #Android#Reverse Engineering#Hardware

    DFRoot Samsung — a cleaner interface, saved diagnostics, and device reports for the Galaxy S22+ project.

    Claude-ReverserJava★14

  • C voice_agent A multi-agent voice shopping backend stitched together with FastAPI and AgentScope, a demo-grade project: without a real merchant scenario it cannot be validated, and the interfaces and results are unclear. Voice-agent scaffolds are plentiful, and this one offers no differentiating capability. #AI Agents#Speech#APIs

    Multi-agent voice shopping assistant backend (FastAPI + AgentScope)

    Sanpan53Python★13

  • C fisher-moss-prompt-expander A SKILL plus ComfyUI template that expands a single idea into a drawing prompt, essentially a prompt collection. Such content is heavily homogenized, results depend on the base model and tuning, and the repo offers no comparable sample outputs. #Prompting#Image Generation#Agent Skills

    Expand ideas into detailed image prompts with a Chinese SKILL and ComfyUI templates.

    Work-FisherPython★20

  • C hanshuang-inject-tool Named a local gateway prompt injection tool with only a one-line description, it's unclear whether it injects system prompts into requests or bypasses provider restrictions. The purpose is vague and likely violates terms of service, so not worth following. #Prompting#Jailbreak#LLMs

    A local gateway prompt injection tool

    aimeoaTypeScript★39

  • C mailflare-macos A macOS email client described in a single sentence, with no explanation of how it beats system Mail or Thunderbird, or which protocols and accounts it supports. With so little information, it's impossible to judge whether it's worth installing. #macOS#Email#Productivity

    Email client for macOS

    hieunc229Swift★53

  • C ARTEX-God A secondary development on ARTEX that piles on one-click getshell, internal lateral movement, and satellite and IoT protocol testing, essentially a repackaged red-team toolbox. It does not say what was changed or why it is more reliable, carrying the usual maintenance and trust issues of fork projects. #Exploits#Network Security#App Security

    ARTEX second-development enhanced version - optimized interception of sensitive operations, added one-click getshell, long-chain post-exploitation, internal network lateral movement, enhanced logic vu…

    Xiao1anGo★16

  • C SelfJev It calls itself a self-hosted 'decision model' compatible with some Jev API, but never explains the model's capabilities, origin or purpose, lumping SDK, fine-tuning and RLCD together. The scope is scattered and the description vague, making it hard to judge whether it's real. #LLMs#ML Research#SDKs

    Self-hosted decision model (selfjev-4b) with a Jev-compatible API: Python SDK, server, fine-tuning and RLCD.

    jwuthri-cloudPython★42

  • C node2mint A self-hosted AI marketplace plus token billing plus an OpenAI-compatible gateway, with reseller commissions too. Feature-packed, but every piece has mature alternatives, and the description emphasizes the commission system most, looking more like a reselling business than a tool. #AI#Fintech#Self-Hosted#APIs

    Self-hosted AI marketplace, token billing engine, and OpenAI-compatible API gateway with atomic balances, provider failover, and affiliate commission system.

    yanstd888TypeScript★17

  • C LastWave-Jam A low-latency sync and in-room chat server for LastWave, implemented in Go. The repo never says what LastWave is, how to integrate, or how it differs from Colyseus or Socket.IO, leaving outside readers unable to get started. #Games#Networking#Self-Hosted

    High-performance, low-latency sync & in-room chat server for LastWave

    Clash-ProjectsGo★14

  • C php2shell-exploit Yet another repo packaging CVE-2026-109618/619 into an exploit framework, heavily overlapping with the same batch of php2shell projects, with no visible new exploit chain or tooling improvement. Unless you need to cross-validate PoCs, there is no reason to look separately. #Exploits#App Security#Network Security

    PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE

    JoasASantosPython★20

  • C HELIX-1.0-Antigravity A "memory and token efficiency" engine for Google Antigravity/Gemini that throws out unverifiable figures like 62–86% amid conceptual jargon. It does not say how to integrate it, and there are no reproducible benchmarks. #AI#LLMs#AI Agents

    HELIX Engine for Google Antigravity & Gemini — local evidence, deterministic memory, and 62–86% token efficiency

    SuperHelix77JavaScript★17

DSkip87
  • D supermimic_vibed It reproduces SuperMimic in an hour and runs LAFAN motion tracking on 1.5 GPUs, showing humanoid imitation learning can be reproduced cheaply, which is useful to the research community. But it's a reproduction, not a new method; commercial outlets depend on robot companies or training platforms, and several similar reproduction repos already exist. #ML Research#Animation#3D

    vibe coded supermimic within 1h, LAFAN passed within 1.5 gpuh training

    zita-chPython★252

  • D rec Claims to be an extremely fast inference engine, but the README gives no throughput, memory, or supported-model data, so 125 stars lack verifiable support. Inference is already crowded with vLLM, SGLang, and llama.cpp; newcomers need a clear niche like edge or specific hardware, and no differentiation is visible. #LLMs#Performance#GPU

    Our lightning-fast inference engine.

    recursive-ossPython★125

  • D glm-5.3-abliterated Essentially resells API keys for several models, bundled with jailbreak prompts and uncensored weights, with the technical content concentrated on bypassing content policy rather than model capability. Its 154 stars in 0.3 days look more like marketing spend, the compliance risk is very high, upstream supply or accounts can be cut off at any time, and there's no sustainable business model. #Jailbreak#LLMs#APIs

    GLM 5.3 Abliterated or Uncensored AI model — 35 jailbreak prompts, model guide and API. One 7API key also covers Claude, GPT, Gemini, Grok, DeepSeek and Kimi.

    7APILanguage unknown★154

  • D php2shell A PoC for the same CVE covering heap exploitation and version detection, but it heavily overlaps several contemporaneous repos, and 106 stars come more from keyword search than unique value. Lacking weaponization packaging or detection capability, it's hard to commercialize and unlikely to become the cited standard among php2shell repos. #Exploits#App Security

    CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)

    syrex1013Python★106

  • D uncensored-ai-api It bundles Claude, GPT, Gemini and others into an OpenAI-compatible unfiltered channel, selling bypass of content policies rather than stronger capability. Its 127 stars depend on sensitive-keyword traffic, and upstream key bans, compliance and payment channels make a stable subscription business hard. #Jailbreak#LLMs#APIs

    Uncensored AI API and models — one key for Claude, GPT, Gemini, Grok, DeepSeek, GLM and Kimi, with uncensored and abliterated variants where available. OpenAI- and Anthropic-compatible. Pay per token.

    7APILanguage unknown★127

  • D php2shell-scanner Non-destructive scanning plus crt.sh subdomain enumeration is a reasonable idea, but the implementation lags far behind Assetnote's version, and 95 stars puts it mid-pack among peers. Commercial scanners easily cover its features and the author lacks distribution, so it is hard to turn into a sustainable product without a vertical asset-mapping service. #App Security#Exploits#Network Security#CLI

    Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

    JoasASantosPython★95

  • D home-tv-cn A minimalist launcher aggregating mainstream video apps for Chinese TV boxes, customized from Aerial, solving ad-heavy and cluttered stock smart-TV home screens. Its 110 stars show real users, but it depends on app compatibility and copyright grey areas, cannot charge money, and could be blocked by app stores or vendors at any time. #Android#UI Design#Video

    Jianju TV: a minimalist Android TV launcher for commonly used video apps in mainland China, customized based on Aerial.

    Jimu888Kotlin★110

  • D Hackintosh-XPS13Plus-IrisXe-Tahoe Getting Metal acceleration working for macOS Tahoe on Raptor Lake Iris Xe is difficult driver work in the Hackintosh community, and 88 stars show niche demand. But it is tied to one machine and OS version, the author says it is unfinished, and it lacks generality while touching Apple licensing terms, so commercial value is limited. #macOS#Hardware#GPU

    Intel Iris Xe (Raptor Lake) Metal acceleration on macOS Tahoe — Dell XPS 13 Plus 9320 OpenCore hackintosh. Work in progress.

    JulioNectarC++★88

  • D ATBGamePort Claims to port all games to the web, but the description is extremely vague with no explanation of porting method, supported list, or compatibility layer, and 227 stars look more like curiosity driven by the title. Web game porting already has mature paths like Emscripten and Ruffle, and this project shows no differentiation, making its technical assets hard to judge. #Game Porting#Games#WebAssembly#Web Frontend

    Transplant all the games to the web platform

    atbfunPython★227

  • D ai-roadmap-2026 Organizes LLM engineering, agents, evaluation, and deployment into a beginner roadmap with free resources, well structured, but similar roadmap repos are extremely saturated, and its 115 stars come mainly from topic traffic. With no code assets, monetization only works via courses or traffic funneling, so it's unlikely to become a depended-on tool or standard. #Learning#LLMs#AI Agents

    AI Roadmap 2026: a beginner's path through Foundations, LLM Engineering, Agents, Evaluation, and Production, with verified free resources and a mini-project per layer

    h9-tecLanguage unknown★115

  • D deepinfer-unpacked This is a community-driven reverse-engineering breakdown of DeepInfer with docs and examples, a learning-oriented teardown whose 94 stars show course and research demand. But such unpacked repos usually lack runnable artifacts, so value sits in the content and monetization only works via tutorials or training, not as a standard dependency. #Learning#ML Research#AI

    Bringing thousands of learners together to unpack DeepInfer through peer-reviewed explanations, documentation, and hands-on examples.

    ZiyuanDuPython★94

  • D SuperMimic-Reproduced A reproduction of SuperMimic's differentiable world model plus BPTT policy on mjlab/MuJoCo Warp, a usable baseline for G1 humanoid motion tracking. But it is a paper reproduction competing directly with another reproduction repo, so 88 stars struggle to stand out and monetization means adoption inside robotics teams. #ML Research#Robotics#AI

    Reproduction of SuperMimic (arXiv:2610.28480): learned differentiable world model + BPTT policy for G1 humanoid motion tracking, on mjlab/MuJoCo Warp

    CuboiLeoPython★88

  • D rom-cli Searches and resumes downloads of ROMs, ISOs, and Switch games in the terminal, with nice Textual-based interaction, and 85 stars show real demand. But the content is almost entirely pirated resources, and legal risk directly blocks commercialization and app distribution, leaving it a gray-area utility. #Piracy#Downloaders#CLI#Games

    Terminal CLI to search and download ROMs, ISOs and Switch games. Interactive Textual UI, cross-platform catalog, resumable downloads.

    danisiberPython★85

  • D PhoneHackScan Claims to check whether an Android/iPhone has been compromised, but beyond one sentence there is no detection method, permission explanation or false-positive handling. Such "phone security scans" are mostly gimmicks, and readers cannot tell what it actually checks. #App Security#Privacy#Android

    Android & iPhone intrusion check

    UCYBERSPython★53

  • D dsh-ascii-ocean It draws sharks and schools of fish in ASCII as a background for DSH conversations. It is a pretty toy whose implementation and purpose are each one sentence, with little reusable value for most developers, saving you ten minutes. #Animation#Terminal#UI Design

    Sharks and schools of fish drawn in ASCII, displayable in the DSH chat background

    GqqQq-QJavaScript★19

  • D grokbot-dsh-orchestrator-vn Uses Grok Bot as a scheduling layer and DeepSeek as a cheap worker, pitched at saving quota and running long unattended sessions. It's essentially an orchestration script for exploiting free quotas, unsustainable and unsuitable as an engineering dependency. #AI Agents#LLMs#Automation

    Biến Grok Bot thành lớp điều phối, DeepSeek Harness làm worker giá rẻ — tiết kiệm quota, chạy liên tục

    diginno-netShell★19

  • D ziping-shushu BaZi chart calculation plus LLM interpretation, aimed at fortune-telling enthusiasts. It's a content-style project wrapping an LLM around traditional divination, with conclusions that can't be verified and limited engineering value. #LLMs#Content Writing#Knowledge Base

    Zi Ping numerology: automatically casts the chart from year, month, day, and hour, retrieves relevant classical texts, and the large model analyzes the chart based on those texts using fixed BaZi calc…

    jiaotukePython★14

  • D vanai A browser MMORPG with a one-line description pointing to an external site. It says nothing about tech stack, gameplay, or open-source scope, so readers can't tell what the repo actually offers. #Games#Web Frontend#Social

    A browser MMORPG, see vanaiworld.com

    philipqnguyenTypeScript★14

  • D folklore-decomp A repository for a PS3 decompilation project of Folklore, titled "with AI" but with no documentation. Decompilation is valuable for preserving old games, but there is no visible progress, toolchain or output here, so outsiders cannot contribute. #Reverse Engineering#Game Porting#Games

    Folklore PS3 Decomp with AI

    Mava-bC★17

  • D Jeva Claims to be the perfect Jellyfin client for Windows, but the repo has no language, screenshots, or install instructions, only a marketing line. Findroid and Jellyfin MPV Shim already suffice, and there's no sign why this is better, so it can't be evaluated yet. #Streaming#Windows#Video

    Jeva is a Perfect Windows client for Jellyfin with a modern, streaming inspired interface

    tearerryLanguage unknown★17

  • D zhixin-campus-showcase An interview showcase version of a campus RAG, explicitly excluding business source code and offering only architecture notes and a compose file. It is essentially a personal portfolio; people wanting to learn RAG get no runnable code, so its value equals a blog post. #RAG#Knowledge Base#DevOps

    Zhixin Campus · Campus RAG knowledge base interview demo version: architecture, technical documentation, and Docker Compose deployment config (business source code not included)

    Sanpan53PLpgSQL★24

  • D twitch-viewer-bot-ai A grey-market tool for inflating Twitch viewer counts, with proxy rotation and AI auto-replies. Its purpose is faking data and evading platform detection, which is neither compliant nor technically valuable, so it's not worth touching. #Automation#Social#Scams

    Twitch viewer bot with AI chat: multi-threaded viewer injection, proxy rotation, GPT-powered chat responders, auto follow/raid.

    hkcjsyzbcgqqPython★62

  • D ns2jb A Switch 2 filesystem jailbreak, reportedly scraped from elsewhere and reworked. Aimed at hacking enthusiasts, it carries high compliance risk, with both origin and completeness in doubt, so it's not worth recommending. #Jailbreak#Reverse Engineering#Exploits

    Switch 2 FS jailbreak (ns2jb) - captured and reworked

    mhzsajanJavaScript★23

  • D he-ipv6-pool The name points to Hurricane Electric's IPv6 address pool and it's automation written in Go, but the repo has no description at all. You can't tell whether it requests, rotates, or benchmarks addresses, or how to configure it; 34 stars appeared in a day with no credible evidence. #Networking#Automation#Linux

    x6nuxGo★34

  • D Dark-Souls-2-RECOMP-ARM64 The description is empty, so the name only suggests a Dark Souls 2 ARM64 recompilation project. With no build instructions or prerequisites, there's no way to judge whether it runs; similar projects from the same period are better documented. #Game Porting#Games#Reverse Engineering

    alesson000C++★15

  • D Roblox-Aimbot-Smooth-Tracking-Auto-Aim-Script-2026 The title is a cheat, and the repo is mostly packaged scripts and downloaders; 300 stars in a day looks more like star farming or traffic funneling than genuine technical recognition. Such projects have very short lifespans, may be banned by platforms or used to distribute malware, and offer neither a business path nor an investment case. #Game Cheats#Games#Scams

    High-performance Roblox aimbot with adaptive smooth tracking and precise auto aim. Fully configurable, works with most executors, clean modular structure. Easy setup for current Roblox version.

    david-silvalab1993i0Python★300

  • D mission-forge An organization's contributor development program covering learning, mentoring, contribution review, and incentives. It's recruitment and coursework rather than usable software, so skip it. #Learning#Collaboration#Jobs

    A contributor development program by Process Mission, combining open-source learning, mentorship, contribution assessments, and performance-based incentives.

    processmission-internJavaScript★16

  • D awesome-marketing-israel An awesome list of Israeli digital marketing tools maintained by a marketing company. It might serve as an index for those entering the Israeli market, but such lists are low-effort, rely on voluntary updates, and carry agency promotion, so it's not worth ten minutes. #Learning#Marketing#Knowledge Base

    Curated list of awesome digital marketing, SEO, MarTech unicorns, performance advertising & growth tools in Israel - curated by BrandTactics.

    sagiveLanguage unknown★15

  • D vc The entire description is one line about an AI-orchestrated coding agent colony, and the README shows no install method, task model, or difference from existing coding agent orchestration approaches. 22 stars in a day looks more like social sharing than real use, with nothing to evaluate at this stage. #AI Agents#LLMs#Automation

    VC - AI-orchestrated coding agent colony

    dyesninourmaGo★22

  • D ai-startup-skills The README is empty, so there's no way to tell what it does or who it's for. It gained dozens of stars within a day of creation, looking more like a repo riding AI startup keywords, with no usable information, so skip it. #AI#Prompting#Learning

    huaxialucaicaiziPython★36

  • D tiktok-dm-blaster A harassment tool for TikTok bulk DMs, auto-follows, account rotation and rate limiting to dodge bans. Its purpose is spam marketing, it solves no real problem, so skip it. #Scams#Automation#Social

    TikTok DM spammer: bulk-sends DMs to usernames, auto-follows targets, rotates accounts, rate-limits to dodge bans. Use at your own risk.

    nevenaywgmheHTML★67

  • D DeRea It calls itself Anti Rea and claims to protect products from reverse engineering, but the description is a single slogan with a grammar error. It doesn't say whether it uses obfuscation, hardening, or detection, and gives no examples. Mature commercial hardening exists; there's nothing evaluable here yet. #Reverse Engineering#App Security#Code Quality

    Anti Rea. Protect your product from been reversed!

    zhcalvinTypeScript★24

  • D PHP2Shell-Full-Chain-Exploit No README description and no usage instructions, with only the repo name hinting at a full exploit chain for the same PHP RCE. It heavily duplicates the dozen or so php2shell repos from the same batch, and there's no way to tell original research from a copy, so it's not worth the time. #Exploits#App Security#Network Security

    78ResearchLabPython★39

  • D mcd-catering-officer The repository has no description, and only the name hints at something related to McDonald's ordering. By the rules, a repo with no explanation of what it does scores nothing, and readers have no way to judge whether it is worth opening. #MCP#AI#Automation

    YvanQianPython★24

  • D php-rce Claims to exploit CVE-2026-109618/109619 for PHP remote code execution, but these IDs can't be found in public vulnerability databases, the repo is one day old, and there are no reproduction steps or affected version notes, so it looks more like a stitched-together PoC collection. Red teams are better off checking nuclei templates or published CVE analyses. #Exploits#App Security#Network Security

    Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

    david-alvarez-rosaPython★30

  • D pi-rs The README is empty, so its purpose can't be determined. It has dozens of stars after just over a day, yet not a single sentence says what it is or who it's for, offering zero information, so skip it. #AI#CLI#Terminal

    lassejlvRust★47

  • D PromptGuard---AI-Privacy-Sanitizer The name says it does privacy scrubbing for AI prompts, but the repo has no description and only HTML pages, so it's unclear whether it's a tool, a demo page, or an empty shell. Plenty of similar redaction tools exist, and without docs or code it can't be evaluated, so not recommended for now. #Privacy#LLMs#Prompting

    xiaoyulei317-droidHTML★53

  • D wemod An activation crack that bypasses WeMod license checks, unlocks Pro and supports auto-updates. Its purpose is circumventing a paywall, which falls squarely in the do-not-look category, so skip it. #Activation Bypass#Crack#Games

    WeMod PRO unlocker: patches license checks, enables remote Pro features, offline activation bypass, and auto-updates patched binaries.

    kzenafuziwjfHTML★71

  • D FDE_Learning No description; the name suggests a study materials repo, but nothing is explained. It gained 130 stars within two days of creation, looking more like star-farming or keyword riding, and can't be evaluated nor is it worth evaluating. #Learning#AI#Knowledge Base

    lusouldepth-aiPython★130

  • D OpenAstolfo The entire description is one line, Astolfo but free and open source, with no indication whether it is an app, skin or model, or who it is for. Name first, content missing, impossible to evaluate. #Games#UI Design#Open-Source Alternatives

    Astolfo, but free and opensource

    DotoryyJava★13

  • D Onimusha-Way-of-the-Sword-FPS-Optimizer Marketed as a frame-rate optimizer for a new Capcom title, this is a typical bundled-distribution lure: 84 stars in 0.3 days, a templated description and no technical detail. Such tools are often used to drop malware or hijack accounts, with no real performance value and no legitimate business path. #Games#Performance#Scams

    Lightweight desktop tool for Onimusha: Way of the Sword. Smart FPS optimization, performance tuning, process management and real-time monitoring. Designed to improve frame rates and stability in Capco…

    NeedlepewallJavaScript★84

  • D html-in-PPT The description is empty, so one can only guess from the name that it puts HTML into PPT, with no way to judge approach or usability. By the rules, no description means a low score, and mature solutions for this kind of conversion have long existed. #Web Frontend#Presentations#Documents

    Silhouette-myHTML★22

  • D .github A typical keyword-stuffed cheat repo baiting with a PUBG cheat menu, whose 174-star growth pattern doesn't match a real project. Such repos usually distribute bundled malware or funnel users to paid cheat sites, with no technical assets or legitimate business, so the risk far outweighs any potential value. #Game Cheats#Games#Scams

    🔥 pubg-cheats-mod-menu-with-aim-esp-wh-cheat-hacks-radar

    bg-tools-newHTML★174

  • D password-agent-sys No description, no language, 49 stars but no explanation at all. Password tools especially need to explain their threat model and storage approach, and here there's nothing. #Secrets#Privacy#AI

    curry897Language unknown★49

  • D skeet-cs2 CS2 cheat source code and reverse-engineering SDK headers, including aimbot, ESP, skin changer and injector. It's game cheating, outside the scope of recommendation, so skip it. #Game Cheats#Reverse Engineering#Exploits

    Skeet/Gamesense CS2 dump: aimbot, ESP, wallhack, anti-aim, skinchanger, injector — reversed SDK headers and cheat source for research.

    onvuehvxqnfxHTML★66

  • D warzone-dlc-unlocker A Warzone DLC unlocker and license bypass tool claiming to unlock all weapon skins, bundled with an injector and spoofer. It's cheating plus piracy, so skip it. #Game Cheats#Piracy#Activation Bypass

    Warzone DLC Unlocker: unlock all DLC weapons, operators, skins and battle pass content, bypass entitlement checks, spoofer and injector included.

    onvuehvxqnfxHTML★71

  • D .github Same template and creation time as the batch of cheat repos, just swapping keywords for a Rust cheat menu; 173 stars doesn't match normal open-source spread. Its core purpose is traffic funneling and malicious distribution, solving no real dev problem and offering no compliant commercialization path. #Game Cheats#Games#Scams

    🔥 rust-cheats-aim-wh-cheat-hack-menu-radar-admin-mod-esp

    rust-tools-newHTML★173

  • D python-ml-cheatsheets A collection of machine-learning cheat sheets, a pure content repo no different from the countless cheat sheets everywhere. It produces no new tools or methods, so by our standard it is skipped. #Learning#ML Research#Documents

    Kavi274HTML★22

  • D tiktok-view-bot Inflates TikTok play counts and live viewer numbers, with proxy rotation and captcha bypass. It's a tool for marketing accounts gaming metrics, but pollution for the platform and other users, and such scripts break within weeks of platform changes. The 65 stars in half a day looks farmed, not worth the time. #Scams#Social#Automation

    TikTok viewer bot: multi-threaded view generator, proxy rotation, watch-time randomization, captcha bypass, live viewer count inflation

    eqyvlbekmlqqHTML★65

  • D jobsweep The repo has no description, only a name hinting at job hunting, and 34 stars of unknown origin. There's no way to tell which sites it scrapes, how to use it, or whether it's compliant, so per the rules it stays off the list until documentation is added. #Jobs#Productivity#Automation

    ybendiksPython★34

  • D planet-zoo-2-save-editor It claims to edit money and research and unlock animals in Planet Zoo 2, but the repo is just an HTML page with no source or documentation, a typical 2026 free mod menu distribution page with no safety guarantees. #Games#Game Cheats#Editors

    Planet Zoo 2 Save Editor 2026 — Edit money, conservation points, research, and unlock all animals. Free offline save editor.

    DreamloboutiqueHTML★25

  • D ReelFlow-Releases Just a release-channel repository whose body says to subscribe for updates, with no source code or product description. Unless you already know what ReelFlow is, there is nothing here to evaluate. #Video Editing#Video#Downloaders

    ReelFlow release channel, please subscribe to the repository for the latest updates!

    RyderweLanguage unknown★41

  • D ScrewStudio The description is empty, and the name alone doesn't reveal whether it's a modeling tool or something else; 22 stars in a day with nothing to evaluate. Repos with no description like this should just be skipped. #3D#Editors#UI Design

    adarshmalpeddiwar-beepHTML★22

  • D dsh-decision-review The README is empty; the name alone suggests some kind of decision review tool. Not a sentence explains what it does or who it's for, leaving no basis for evaluation, so skip it. #AI#Collaboration#Knowledge Base

    ninetyhe-90JavaScript★31

  • D rom-cli A command-line script for downloading ROMs, essentially a piracy channel. There's nothing technically new and the legal and compliance risks are clear, so it's excluded outright. #Piracy#Downloaders#Games

    Download roms via cli

    sostenesapolloPython★28

  • D h3-motion-creator No description and no README, so one can only guess from the name that it relates to motion generation. A repo like this cannot be judged usable; the author should add a README before submitting. #Animation#3D#AI

    KarakuriAgentTypeScript★16

  • D DLSS5-Unlocker Claims to unlock DLSS 5 and frame generation on any NVIDIA/AMD GPU with one click, which contradicts hardware reality, and "ultimate one-click" is typical promotional phrasing. It can basically be judged a fake unlocker or bundled-installer lure. #GPU#Games#Scams

    Unlock and manage DLSS 5 on any NVIDIA or AMD graphics card. The ultimate one-click frame gen tool.

    SmokeProductionLanguage unknown★82

  • D Camtasia Pirated distribution under the banner of a full Camtasia 2026 installer, claiming standalone installation. It's pirated material, outside consideration, so skip it. #Piracy#Video Editing#Crack

    Camtasia 2026: Full working installer with complete standalone setup, ready for professional video editing and screen recording.

    metalgiverquayLanguage unknown★45

  • D hackios-web No description; the name alone suggests something iOS-related. It explains neither its purpose nor how to use it, yet gained dozens of stars in just over a day, so it can't be evaluated; skip it. #iOS#Exploits#Reverse Engineering

    oosexgangTypeScript★37

  • D hackios-xnu-kernel No description, yet it hit 491 stars in under a day. With no stated purpose, this growth looks like star farming or keyword bait around iOS kernel terms, so it can't be judged and isn't worth judging. #iOS#Exploits#Reverse Engineering

    oosexgangC★491

  • D hackios-xnu-userland Like the rest of the series, no description; only the name hints at iOS userland. Zero information and abnormal star growth mark it as part of the same batch of suspicious repos, so skip it. #iOS#Exploits#Reverse Engineering

    oosexgangC★226

  • D PS5_Uninstaller The description is only half a sentence, "This tool helps you", not even finishing what it does, and the 24 stars are inexplicable. With no usage or principle, it cannot be evaluated; skip it. #Games#Windows#Reverse Engineering

    This tool helps you

    YahballonC++★24

  • D minions No description, no language tag, 26 stars of unknown origin, and no clue what the Minions-like name intends. By the rule that no description means a low score, readers have no reason to click. #AI#LLMs#Agent Skills

    athenav135Language unknown★26

  • D ascii-reveal No description; the name hints at some ASCII display effect. With no stated purpose or usage and no added info a day after creation, it can't be evaluated, so skip it. #CLI#Terminal#UI Design

    quanhoangindexTypeScript★16

  • D latto There is no description or README, and from the QML one can only guess it is a desktop widget. A repo that cannot even say what it does cannot be evaluated; the author should add one line on its purpose. #UI Design#Linux#Productivity

    FadilixQML★13

  • D MyFoldy No description and no README, only that it is a Kotlin project. Its purpose cannot be determined; the author should add a README and screenshots. #Android#Productivity#Documents

    Piyushingle007Kotlin★16

  • D Imei-Repair An "all features activated" installer package billed as an IMEI repair tool, with no source code or technical documentation — a typical lure download page. Never run it on your phone under any circumstances. #Scams#Crack#Activation Bypass

    Imei Repair Free 2026 - Full working installer with all features activated, ready to run on your desktop.

    WallScorpionLanguage unknown★48

  • D CoD-MW4-Vanguard-CHEAT-Menu A claimed undetected Call of Duty cheat with aimbot, ESP, HWID spoofer, and anti-cheat bypass. It ruins others' gameplay and evades detection, a clear exclusion regardless of star count. #Game Cheats#Games#Exploits

    Premium Call of Duty MW4 mod menu. Undetected aimbot, full ESP, unlock all, HWID spoofer. External overlay with Ricochet bypass.

    speedydividHTML★18

  • D cs2-external-esp A CS2 external ESP and aimbot cheat packaged as teaching research. Its core function is cheating and evading detection, and the code's origin and safety can't be verified, so it's excluded. #Game Cheats#Games#Exploits

    CS2 external cheat: ESP player boxes, skeleton, health bars, radar hack, aimbot, glow, no-flash — external overlay for educational cheat-dev research.

    tunflwgudkybHTML★67

  • D deadlock-external A Deadlock external ESP and aimbot with an injector, again framed as research. It's just another entry in the cheat ecosystem with no discussable technical value, so it's excluded. #Game Cheats#Games#Exploits

    Deadlock external cheat: ESP wallhack, aimbot, skeleton overlay, radar — educational reverse-engineering reference, injector included.

    urdtbittefnuPython★63

  • D pubg-external-esp A PUBG external ESP and aimbot claiming a DMA read-only overlay. The feature description is simply cheating, and such repos often carry trojans, so it's neither recommended nor worth analyzing. #Game Cheats#Games#Exploits

    PUBG external ESP/aimbot: player skeleton ESP, item glow, no-recoil, radar — read-only DMA overlay for cheat research.

    wpfigfszroxnHTML★67

  • D yt-view-bot A multithreaded YouTube view-count bot with proxy rotation and fingerprint spoofing. This is a platform fraud tool that harms advertisers and creators, so it's excluded outright. #Scams#Social#Marketing

    YouTube view bot: multi-threaded view inflation, proxy rotation, watch-time retention, and randomized user-agent/device fingerprinting per view.

    yatrjzgbwursHTML★73

  • D Veldanabwah A personal homepage README with an animated fish, containing no software and giving no sense of what the author does. The 40 stars likely come from mutual follows and exposure, offering readers zero information. #Social#Content Writing#Marketing

    Profil gue — versi yang ada animasinya 🐟

    VeldanabwahLanguage unknown★40

  • D .github Both the repo name and contents are a desktop installer distribution page impersonating 1Password, with no source code or description, a typical name-squatting mirror. It has zero value for developers; ignore it. #Crack#Piracy#Windows

    🔥 1password-passmanager-for-pc-mac-windows-desktop-password-manager-app

    1-tool-newHTML★44

  • D KMS-Pico A fully unlocked installer package under the KMS Pico name, a common disguise for pirated activators and malware. No source, no description, and running it is a risk. #Crack#Activation Bypass#Piracy

    Kms Pico Free 2026: Full working installer with all features unlocked for immediate use.

    digitalmilleradoreLanguage unknown★47

  • D python The repo is simply named python, with no description or docs, so it's unclear whether it's notes, practice, or a placeholder. It gained 29 stars in a day with nothing to back it up, so treat it as an empty shell. #Learning#Documents#Productivity

    rahularya98Python★29

  • D python The repo is named after a language with no description, appeared the same day as another repo from the same account with an identical star count, showing clear star-farming signs. There's no usable information. #Learning#Documents#Productivity

    vermaadi9670Python★36

  • D script No description, same day and same star count as the same account's python repo, likely a batch star-farming placeholder. It doesn't constitute an evaluable project. #Learning#Documents#Productivity

    vermaadi9670Python★36

  • D The-Flash-USDTBTC-Demo The so-called Flash Sender is a typical fake USDT/BTC transfer demo pitch, all marketing language with no verifiable implementation. It belongs to the grey market and is best avoided. #Scams#Crypto#Blockchain

    Crypto Flash Sender Software is Packed With Advanced Functionalities Engineered For Optimal Performance And Free Demostration user Experience.

    Ach776547Language unknown★21

  • D BorisFX A standalone installer claiming to fully unlock BorisFX 2026, with no source or documentation, is a typical pirated-software distribution page. The risk far outweighs any benefit. #Crack#Piracy#Video Editing

    Complete standalone setup of Borisfx 2026, your go-to video editing and visual effects solution, ready to run with all features unlocked.

    AzureTeacherPlantLanguage unknown★44

  • D LossLess-Scaling It claims to be a complete working installer for Lossless Scaling 2026, with no source or documentation, making it pirated distribution. Do not download or run it. #Crack#Piracy#GPU

    Lossless Scaling 2026 - Full working installer, complete standalone setup ready to run.

    DelegateAdmireLanguage unknown★46

  • D Cinema-4d The so-called Cinema 4D 2026 fully unlocked standalone installer, with no source or documentation, is pirated distribution. Just ignore it. #Crack#Piracy#3D

    Professional Cinema 4D suite 2026 complete standalone setup, ready to run with all features unlocked.

    HopeMediatorLanguage unknown★44

  • D Discord-Quest-Completer An installer distribution page claiming to complete Discord tasks, with no source code or documentation — a typical gray-market package spread under the guise of automation. Do not download or run it. #Crack#Scams#Piracy

    Discord Quest Completer 2026: Full working installer for a seamless desktop experience, ready to run right out of the box.

    MarooniogripLanguage unknown★48

  • D hello_world- The content is just a hello_world with nothing usable. Gaining 62 stars in a little over a day looks more like mutual starring and carries no signal. #Learning#Documents#Knowledge Base

    hello_world

    MrquillwingLanguage unknown★62

  • D dummy Named dummy with no description and unclear HTML content. A typical placeholder or star-farming repo with nothing to evaluate, so it doesn't enter recommendations. #Learning#Documents#Productivity

    taniyav982HTML★29

  • D python Appeared the same day as another dummy repo from the same account, with no description or content and just a language name. It's a placeholder or practice repo with no visible problem to solve. #Learning#Documents#Productivity

    taniyav982Python★29

  • D Classetta No description, just a Python tag and a dozen stars, with no clue what it does. Repos without a stated purpose are skipped until the author adds one. #Learning#Documents#Productivity

    theeggcrusher2Python★16

Show HN 2

B

It decodes BRAW/R3D/ProRes and transcodes directly in the browser, turning a step that required desktop software into a link, a real need for film crews and footage review. Kino itself is a browser editing and MAM vendor, with transcoding as a customer-acquisition entry, so the commercial path is clear. Risks are codec licensing, 8K performance, and competitors like Frame.io.

I'm Luke from Kino. We make a video editor + MAM in the browser. Transcode opens Blackmagic RAW, RED R3D, ProRes, DNxHR, and MXF files in the browser (including the famously tricky OP-Atom). You can s…

#Video#WebAssembly#Web Frontend#ffmpeg

▲8

B

Turns UI micro-interactions into a prompt library that can be fed directly to AI, solving the frontend motion problem of knowing what you want but not how to write it. Its 68 points show designers and frontend devs genuinely feel this pain, and paid prompt packs plus small-team subscriptions are ready monetization paths. Risks are that prompt assets are easily copied and lose their premium once built into tools like Cursor.

#Prompting#UI Design#Web Frontend#AI

▲68

Hot New Repos

  1. ikow/php2shell-poc★1515 CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
  2. 9bie/php2shell-bypass-aslr-exp★953 A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
  3. eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC★885 Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
  4. openai/php2shell-checker★812
  5. colinhacks/reylo★656 Import .sql files into TypeScript with full type inference and zero codegen.
  6. Acelogic/Snapintosh★546 EL2 hypervisor and toolchain that boots macOS on the ASUS A16 (Snapdragon X2 Elite), with an Adreno Metal/IOGPU stack
  7. oosexgang/hackios-xnu-kernel★489
  8. wesbos/3d-model-anything★470 Capture iPhone LiDAR and photos, reconstruct editable Three.js rooms, and explore them in a browser.
  9. WoYun520/dsh-purge★401 DeepSeek Harness Purge (mirror of mmparko/dsh-purge) — full mirror: all branches / 100 tags / complete commit history. Original author credit in README.
  10. Alejandros17487/ai-jailbreaks★330 AI jailbreaks: 35 paste-ready AI jailbreak prompts for 25+ frontier and open-weight models - system prompts, AGENTS.md specs, and Ollama Modelfiles. Built for AI security research and red-team testing.

Star gain 1d

  1. morluto/rea+8470★366122
  2. Gathin23/cleanyourtv+4934★23971
  3. Gathin23/tv-vibehack+4934★23968
  4. cloudflare/security-audit-skill+3109★39522
  5. Ebony-Vinyl/dsh-our-free-model+2934★36726
  6. zouyuxuan122/dsh-our-free-model+2933★36727
  7. peach-mitao/peach+2079★2461
  8. deepseek-ai/DeepInfer+2044★19847
  9. DietrichGebert/ponytail+1843★173431
  10. ifixai-ai/iFixAi+1688★33162

GitHub Trending · Today

GitHub's own order · heat relative to usual, not stars gained

  1. php/php-src+287★41139 #Web Frontend#APIs#SDKs#Build#php
  2. anthropics/knowledge-work-plugins+303★31570 #Plugins#Productivity#Documents
  3. DietrichGebert/ponytail+1948★173426 #Agent Skills#Prompting#AI Agents
  4. cloudflare/security-audit-skill+2979★39514
  5. Graphify-Labs/graphify+1408★132919 #Agent Skills#AI Agents#Knowledge Base#claude-code#cursor
  6. supabase/supabase+693★113472 #Databases#APIs#Self-Hosted#AI#postgres
  7. fastapi/fastapi+101★103727 #APIs#Web Frontend#SDKs#Performance
  8. luongnv89/claude-howto+177★43173 #AI Agents#Agent Skills#Prompting#Learning#claude
  9. Meloong-Git/PCL+119★8682 #Games#Windows#Downloaders#minecraft

GitHub Trending · This Week

GitHub's own order · heat relative to usual, not stars gained

  1. morluto/rea+106341★366082 #Reverse Engineering#AI Agents#Automation
  2. anthropics/claude-plugins-official+5649★43886 #Plugins#Agent Skills#AI Agents#CLI
  3. ruvnet/ruflo+3708★78483 #AI Agents#Automation#LLMs#Collaboration
  4. android/skills+1384★9243 #Agent Skills#Android#AI Agents#Learning
  5. K-Dense-AI/scientific-agent-skills+3967★53886 #Agent Skills#AI Agents#Science#Data Analysis
  6. anomalyco/opencode+6750★220201 #AI Agents#CLI#Terminal#Productivity
  7. HKUDS/CLI-Anything+3275★56229 #CLI#AI Agents#Automation
  8. cursor/plugins+2046★13606 #Plugins#Editors#AI Agents
  9. akitaonrails/ai-memory+3322★12773 #AI Agents#CLI#Knowledge Base#Productivity
  10. debpalash/VoiceStudio+13581★81736 #Speech#Audio#Open-Source Alternatives#elevenlabs

GitHub Trending · This Month

GitHub's own order · heat relative to usual, not stars gained

  1. paperclipai/paperclip+25127★106156 #AI Agents#Productivity#Collaboration
  2. debpalash/VoiceStudio+47620★81736 #Speech#Audio#Open-Source Alternatives#elevenlabs
  3. heygen-com/hyperframes+17770★69999 #Video#Web Frontend#AI Agents
  4. vectorize-io/hindsight+28067★52740 #AI Agents#Knowledge Base#ML Research
  5. NVIDIA/OpenShell+8473★17742 #AI Agents#Privacy#Self-Hosted
  6. cloudflare/security-audit-skill+18566★39514
  7. mksglu/context-mode+8015★31827 #AI Agents#MCP#LLMs
  8. anthropics/knowledge-work-plugins+6026★31570 #Plugins#Productivity#Documents
  9. NationalSecurityAgency/ghidra+13804★93148 #Reverse Engineering#Debugging#App Security
  10. anthropics/claude-plugins-official+7380★43886 #Plugins#Agent Skills#AI Agents#CLI