BrokeIt - Trending Repos

Daily open-source news in about ten minutes. Every morning, a hype-chaser and a security skeptic break down the trending GitHub repos, releases, and dev-tool launches that actually matter. Kai stars everything new; Sam asks if the stars are real. Together they cut through the noise to what's real, what's overblown, and what it means for you. Fast, sharp, and honest. New episode every weekday. From the team at brokeit.dev.

32 episodes

8d ago latest

daily cadence

English language

▶ Play latestRSS feed Website Technology

https://brokeit.dev/shows/trending-repos/feed.xml

Episodes 38

BrokeIt - Trending Repos — 2026-07-17
1mo ago · 6:38
OpenAI launches ChatGPT Work + GPT-5.6, merges Codex into one desktop app • Kimi K3: Moonshot ships 2.8T-parameter open-weight frontier model (weights on July 27) • Ollama raises $65M Series B; hits ~176k GitHub stars
2.8T Kimi K3 Goes Open, Grok CLI Backlash, npm Locks Down Installs
1mo ago · 2:04
Moonshot AI releases Kimi K3, ~2.8T-param open-weight MoE with 1M context • xAI open-sources Grok Build CLI after backlash over silent repo uploads • npm v12 ships, blocking install scripts, Git deps and remote sources by default
6M Fake GitHub Stars, AsyncAPI Botnet Hijack, X Goes Open Source
1mo ago · 7:25
AsyncAPI npm packages hijacked to deliver multi-stage botnet malware • X (formerly Twitter) to open-source its entire codebase after security review • CMU study maps GitHub's fake-star economy: 6M suspected fake stars across 18,617 repos
AsyncAPI backdoored, npm v12 kills install scripts, 6M fake GitHub stars
1mo ago · 7:04
npm v12 ships, disabling dependency install scripts by default • @asyncapi npm org backdoored via GitHub Actions "pwn request" • Fake-star momentum: ~6M suspected fake GitHub stars, and suspicious trending repos
WordPress RCE exploited, TypeScript 7.0 12x faster, critical nginx flaw patched
1mo ago · 7:39
WordPress 'wp2shell' RCE exploited in the wild as public PoC fuels mass scanning • TypeScript 7.0 ships stable: Go-based compiler rewrite delivers 8–12x faster builds • Critical nginx flaw CVE-2026-42533 can crash workers and may allow RCE; F5 patches
Six Million Fake Stars, npm v12 Blocks Install Scripts, Shai-Hulud Strikes Again
1mo ago · 6:39
Shai-Hulud strikes again: four more supply-chain attacks hit npm and PyPI • npm v12 ships this month, blocking dependency install scripts by default • 'Six Million (Suspected) Fake Stars on GitHub' — research and open analysis fuel fake-star vetting
500K Macs Escaped, npm-PyPI Swarmed, 11-Byte TLS Freeze
1mo ago · 6:38
SharedRoot: Sandbox Escape in Anthropic's Claude Cowork Exposed ~500K macOS Users • The Streak Continues: Four More Supply-Chain Attacks Hit npm and PyPI (Shai-Hulud) • OpenSSL 'HollowByte' Flaw Could Freeze Server Memory with 11-Byte TLS Requests
New Shai-Hulud npm attacks, Rust grammar checker Harper, Pumpkin Minecraft server
1mo ago · 6:31
Four more supply-chain attacks hit npm and PyPI in new Shai-Hulud wave • Harper: Automattic's offline, privacy-first Rust grammar checker trends • Pumpkin: fast Rust Minecraft server climbs GitHub Trending
6M Fake GitHub Stars, EVE Online Engine Open-Sourced, snapd Root Flaws Patched
1mo ago · 6:41
CMU study: 6M fake GitHub stars across 18,617 repos; stars sold for pennies • EVE Online's Carbon engine (Trinity + Destiny) open-sourced under MIT • Canonical patches 3 snapd CVEs incl. local root privilege escalation
Rust cracks TIOBE top 10, Blender 5.2 LTS node physics, Linux 6.18.40 stable
1mo ago · 6:30
Blender 5.2 LTS lands with node-powered physics and online asset libraries • TIOBE July 2026: Rust breaks into the top 10 for the first time • Linux Kernel 6.18.40 and five LTS branches released in a massive July stable cycle
npm kills install scripts, massive Linux rc5, Framer agents on canvas
1mo ago · 6:52
Linux 7.2-rc5 released: 'once more a massive -rc5' with heavy networking + audio fixes • npm v12 ships this month, disabling install scripts by default to blunt supply-chain attacks • Framer ships Agents-on-canvas, Branching, and a creator Community (Product Hunt #1 tier)
Curl rejects AI slop, Debian debates AI ban, Firefox 153 adds Vulkan video
1mo ago · 6:51
Debian developers debate a project-wide ban on AI-assisted contributions • curl doubles down on rejecting 'AI slop' security reports • Firefox 153 released: Vulkan video decoding, experimental JPEG-XL, profile management
Six Million Fake GitHub Stars, PyPI Locks Old Releases, Block's Buzz Rival
1mo ago · 6:45
Jack Dorsey's Block launches Buzz — an open-source, Nostr-based rival to Slack and GitHub • PyPI blocks new file uploads to releases older than 14 days to stop package poisoning • Study: Six million suspected fake stars on GitHub fueling spam and malware
Node.js Patches 10 CVEs, Registries Fight Poisoned Packages, Postgres 19 Graph Queries
1mo ago · 6:40
Node.js ships emergency patches 22.23.2, 24.18.1 & 26.5.1 fixing 10 CVEs across all active lines • New GitHub and PyPI policies target fast propagation of poisoned packages • PostgreSQL 19 Beta 2 released with native SQL/PGQ graph queries and unified REPACK
X open-sources code, Xen 4.22 adds Zen 5, Ghostty 1.3.0 lands
29d ago · 7:08
Musk says X will open-source its full codebase in August 2026 • Xen Project 4.22 released with AMD Zen 5 support, FRED, and improved RISC-V virtualization • Ghostty 1.3.0 terminal ships with easier command history search
Fake SQLite CVE, Taylor Farms' Fourth Rewrite, Pavlo Joins ClickHouse Labs
27d ago · 9:32
Critical CVE issued for hallucinated SQLite vulnerability • Taylor Farms Has Rewritten Its Cyclospora Statement Four Times in Sixteen Days • Andy Pavlo Joins ClickHouse to Establish ClickHouse Labs
Nashville blocks data center with eminent domain, ditching Android for Linux, Zed's DeltaDB
24d ago · 10:26
Nashville uses eminent domain to block data center near zoo • I'm switching my phone from Android to Linux • Zed DeltaDB
Meta's $942M Kids Verdict, AMD Etches AI in Silicon, GPT-5.6 Expands
23d ago · 11:50
AMD acquires Taalas to boost inference performance by etching models in silicon • Meta Ordered to Pay $942M to Address Harm to Kids from Social Media • Improving GPT‑5.6 Sol in ChatGPT, expanding GPT‑5.6 Luna access for free users
Nixpkgs Core Team Disbands, DeepSeek V4 Flash Drops, DOE Launches Genesis Models
22d ago · 10:37
DeepSeek V4 Flash 0731 • The Nixpkgs core team has disbanded • U.S. Department of Energy Launches the Genesis Open Models Initiative
Supersonic trebuchet, Weather app eats 1GB RAM, Dark Hours mea culpa
21d ago · 5:49
Windows 11's built-in Weather app wastes more than 1 GB of RAM • Mea Culpa – Dark Hours • Tom Stanton's supersonic trebuchet breaks sound barrier with gravity alone
Claude Code Auto, AI Commons Tragedy, Agentic Dev
20d ago · 6:08
Auto mode is now the default in Claude Code • The tragedy of the commons, AI edition • OpenChamber: An Agentic Development Environment
Grok 4.6 Scores 61, Warrant for LPRs, 16-Year SQLite Bug
18d ago · 6:55
SpaceXAI's Grok 4.6 Scores 61 on the Artificial Analysis Intelligence Index • License plate reader searches should require a warrant • Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug
$400M Lovable raise, DeepSeek V4 Pro AI, Pixel Watch 5
17d ago · 7:19
DeepSeek V4 Pro 0813 • Lovable raises $400M Series C • Pixel Watch 5
Ultrafast GPT-5.6 Sol, Emergent Cyber, Bluesky Protocol
16d ago · 6:31
Accelerating GPT-5.6 Sol Ultrafast • GLM-5.3: Frontier Coding with Emergent Cyber Capabilities • Bluesky Protocol Services
Homomorphic Encryption, Hand-Built AI, Private AI, Claude Code Maxed
15d ago · 7:33
Google is making private AI practical with homomorphic encryption • AI by Hand • Maximizing the value of your Claude Code sessions

Episodes

Reading the feed…

Also on brokeit.dev

BrokeIt - Daily AI News

brokeit.dev

35 episodes · 8d ago

BrokeIt - Feed Drop

brokeit.dev

18 episodes · 8d ago

More Technology shows

BrokeIt - Trending Repos

Episodes 38