GitHub trends for November 9, 2026

What was taking off on GitHub on November 9, 2026: peak magnitude of the day, summary and where it was spotted.

9.1
sherlock-project/sherlock
Python CLI tool that hunts down accounts by one or more usernames across 400+ social networks. Used in OSINT and reconnaissance to check a user's online presence.

BreakoutSecurityPython≈ +2,557 stars by the end of the day
8.9
meta/astryx
An open source design system on React 19 and StyleX with 150+ accessible components, themes, and a CLI, built for people and AI assistants to work the same way. It grew inside Meta, where it powers 13,000+ apps.

BreakoutWeb & frontendTypeScript≈ +2,232 stars by the end of the day
8.0
NotRexed/Hookshot
Hookshot is a static recompilation of The Legend of Zelda: Ocarina of Time from the Nintendo Switch 2 version, letting it run natively on Windows without an emulator, built from your own copy of the game.

BreakoutGames & graphicsC++≈ +1,060 stars by the end of the day
7.9
IainKay/ram-altman
A bash script that samples Linux RAM usage from /proc/meminfo and emails a daily joke report to Sam Altman about unused memory, with CSV logging and tests.

Early signalOtherShell≈ +631 stars by the end of the day
7.8
jamesondh/chimera-vocal-synth
A browser-based vocal synthesizer built on physical modeling: sound comes from a simulated airway rather than samples. The Rust engine compiles to WebAssembly for an AudioWorklet and also runs natively via a CLI.

Early signalGenerative mediaRust≈ +480 stars by the end of the day
7.8
tangerineturtle1/NX2navi
Static recompilation of The Legend of Zelda: Ocarina of Time from Nintendo Switch 2 to a native Windows x86-64 application with a Vulkan renderer. Requires a user's own legally dumped copy of the game; aimed at players…

Early signalGames & graphicsC≈ +898 stars by the end of the day
7.6
DIYgod/pinky
Pinky lets AI agents (Claude Code, Codex, Cursor, etc.) operate a real iPhone or Android phone over MCP while you watch from your computer and approve risky steps. Pinky's gateway enforces approvals for payments,…

Early signalAI agentsGo≈ +627 stars by the end of the day
7.5
jhaizhou-ops/S2Arm
A project for running your own Nintendo Switch games natively on iPhone, iPad and Mac: game code is statically recompiled to ARM64 and runs directly on the processor, with graphics going to Metal. You bring your own…

Early signalGames & graphicsC#≈ +488 stars by the end of the day
7.5
Minireel/HGhub
Third-party client for the Huangguo short-drama site, built with Tauri 2, Rust and React for Windows and Android with a vertical feed and a full player (HLS + AES-128, speed, PiP).

BreakoutAppsTypeScript≈ +867 stars by the end of the day
7.3
JuneYaooo/rea-video
A skill for AI coding agents that reverse-engineers any video shot by shot, identifying whether each shot is live-action, AI-generated, 3D, or code-driven, and producing a replication plan.

BreakoutAI agentsPython≈ +764 stars by the end of the day
7.1
shanselman/gputaskman
A terminal GPU monitor in the spirit of htop: shows per-process VRAM and engine activity plus loaded runtimes, model files, and LLM buffer breakdowns (weights, KV cache). Runs on Windows (NVIDIA/AMD), Linux, and WSL.

Early signalDeveloper toolsPython≈ +480 stars by the end of the day
7.0
sarpstar/cinecode
Turns a one-line idea into a finished MP4 by having an AI coding agent write the script, build every frame in code and design the sound, running locally inside Claude Code or Cursor.

BreakoutGenerative mediaPython≈ +486 stars by the end of the day
7.0
vercel-labs/agent-browser
A Rust CLI for browser automation aimed at AI agents: it opens pages, clicks elements, fills forms, and takes screenshots via simple commands.

BreakoutAI agentsRust≈ +635 stars by the end of the day
6.8
dsx-ai-factory/nvke
NVKE is a management plane for running managed Kubernetes clusters on your own bare-metal NVIDIA GPU infrastructure, provisioning workload clusters through NICo and Cluster API. It targets platform teams that offer…

Early signalDevOps & infrastructureGo≈ +261 stars by the end of the day
6.7
anomalyco/rune
A native Rust UI framework with its own GPU renderer, text, layout and springs for macOS, Windows, Linux and the web. Apps can run headless, letting agents render to PNG and drive the UI with scripted input.

BreakoutWeb & frontendRust≈ +1,102 stars by the end of the day
6.7
synchopate/llama-modchip
Tool for running large MoE models (DeepSeek-V4-Flash 284B, Nemotron-30B) on pure CPU with 64 GB RAM and no GPU, using a custom Fractal-64 compression format and speculative decoding.

Early signalLanguage modelsPython≈ +403 stars by the end of the day
6.6
google-deepmind/mujoco
A general-purpose physics engine for simulating articulated structures with contacts, used in robotics, biomechanics, graphics and reinforcement learning. Provides a C API, Python bindings, a native GUI and a Unity…

BreakoutScience & researchC++≈ +360 stars by the end of the day
6.6
reacher-z/Awesome-REA
An independent curated collection of reverse-engineering tools, case studies and research papers covering websites, games, apps, native binaries, firmware and protocols. It indexes 3,300+ resources and organizes them…

BreakoutSecurityPython≈ +302 stars by the end of the day
6.5
sentinelsoldierprize/Minecraft-AFK-Bot
A Node.js/Mineflayer Minecraft bot that joins a server as a player, simulates head movement and jumps to avoid AFK kicks, and auto-reconnects when disconnected. Controlled via a localhost web dashboard.

Early signalGames & graphicsPython≈ +152 stars by the end of the day
6.4
Th0rgal/satmux
A proxy for satellite Wi-Fi that accelerates content loading in the field by bypassing onboard proxies and GEO latency using BBR and TLS.

Early signalOtherPython≈ +269 stars by the end of the day
6.3
CzJam/gjgjxweb
A web-based Android tweaking toolbox. It ports the PC 'Gaoji Toolbox' via Tango/WebADB and xterm.js, providing an ADB graphical interface and interactive shell in Chromium browsers.

Early signalDeveloper toolsHTML≈ +292 stars by the end of the day
6.3
lxe/phoneuse
Tool to see and operate an unmodified iPhone from a Linux PC: screen arrives over AirPlay while the PC acts as a Bluetooth mouse and keyboard. Includes a CLI and MCP server for agents.

Early signalAI agentsC≈ +235 stars by the end of the day
6.2
libracoder/kiri
A lightweight container runtime written in Rust for macOS, Windows and Linux, compatible with the Docker Engine API and CLI. It replaces Docker Desktop and OrbStack by running containers in a single small Linux VM.

Early signalDevOps & infrastructureRust≈ +274 stars by the end of the day
6.1
Leviidev/Henge
Henge is an emulator that runs macOS on iPhone and iPad by executing the Mac's arm64 code through its own JIT, MMU and virtual devices, without QEMU or Virtualization.framework. It downloads Apple's restore image and…

Early signalAppsC≈ +305 stars by the end of the day
6.0
Torquatoatkins/Drainer-Tool-Solana
A tool that automatically drains SOL and SPL tokens from Solana wallets: it monitors balances via RPC websocket and transfers funds to a specified address. The author states it is for educational and research purposes…

Early signalSecurityPython≈ +138 stars by the end of the day
5.9
CityPulso/PulsoIcon
An animated icon set: 9955 icons, each with its own motion, for React, Vue, Svelte, Jetpack Compose and SwiftUI. In React it replaces lucide-react with a one-line import change.

Early signalWeb & frontendKotlin≈ +202 stars by the end of the day
5.9
sassiestrhihno/boxshelf-beta
Boxshelf is a TV-style launcher for emulators, Steam games and media apps: games sit on a 3D shelf with real box art, and cases can be flipped, opened and manuals read. Public beta for Windows, Android (AYN Thor) and…

Early signalApps≈ +298 stars by the end of the day
5.8
Sandflow-ai/sand3d
A Python library for describing 3D objects as short programs over Blender's bpy, with named parts, joints and assemblies, designed so an LLM can write a model in a few hundred tokens. Exports to GLB, URDF, USDA, OBJ…

Early signalGames & graphicsHTML≈ +269 stars by the end of the day
5.7
PierHelmsman/atas-trading-bot
The repository poses as a pre-activated Atas Trading Bot build for Windows, but instead of files it tells you to run a PowerShell script from an external domain. It looks like malware distribution disguised as a free…

Early signalSecurity≈ +346 stars by the end of the day
5.7
PlanetCraneInterface/autodesk-revit
The repository poses as a pre-activated Autodesk Revit 2026 build for Windows, but it is actually a script that downloads and runs third-party PowerShell code from an external domain. No real Revit installer is included.

Early signalSecurity≈ +346 stars by the end of the day
5.7
PlateCashier/autodesk-cfd
A local deployment package for Autodesk CFD 2026 on Windows x64, presented as a pre-activated build requiring no registration or license setup. The README instructs running a PowerShell script from an external domain…

Early signalOther≈ +346 stars by the end of the day
5.7
ppmpreetham/BUI
BUI is a C UI library extracted from Blender's interface: its widgets, interaction rules and look are usable from Python, Rust, JavaScript/React, C, C++ and Dear ImGui. It lets you build fast native desktop apps with…

PeakingDeveloper toolsC++≈ +121 stars by the end of the day
5.7
Prideoidemultiplexer/catia-cad
A repository that claims to offer a pre-activated Catia CAD build for Windows, but its README only contains instructions to run an obfuscated PowerShell script from an external domain, which is a common malware…

Early signalOther≈ +346 stars by the end of the day
5.7
RockProtectorGraph/dxo-photolab-10
A repository that claims to offer a pre-activated free build of DxO PhotoLab 10 for Windows, but its README only contains instructions to run an obfuscated PowerShell script from an external domain. This is a typical…

Early signalOther≈ +346 stars by the end of the day
5.7
rushlizardsymbolize/easy-worship
The repository offers a "pre-activated" Easy Worship build for Windows and installation via a PowerShell command that downloads a script from an external domain. It is not really an open-source project but instructions…

Early signalOther≈ +346 stars by the end of the day
5.7
SamuraiOcean79/dvd-creator
Repository offers a pre-activated DVD Creator build for Windows x64 installed via a PowerShell script. The README contains no product description and looks like a lure to run third-party code.

Early signalSecurity≈ +345 stars by the end of the day
5.7
scarletboulderguard/fabfilter-pro
Fabfilter Pro 2026 pre-configured environment for seamless desktop software utility execution.

Early signal≈ +346 stars by the end of the day
5.7
seizepupatackle/fl-studio
The repository poses as a pre-activated FL Studio build for Windows, but is actually a loader script that runs third-party PowerShell code from an external domain. This is a classic malware distribution scheme…

Early signalSecurity≈ +346 stars by the end of the day
5.7
SettlementCarpenter/frp-unlock-tool
The repository poses as a pre-activated FRP Unlock installer, but it is essentially a script that tells users to disable Windows protection and run remote code. There is no actual FRP unlock tool here.

Early signalSecurity≈ +346 stars by the end of the day
5.7
snatchportername/ios-unlocker
A local deployment package for Windows x64 positioned as an environment for iOS device management and diagnostics. The README instructs running a PowerShell script from an external domain to install it.

Early signalSecurity≈ +346 stars by the end of the day
5.7
soulsparrowmove/kontakt-8
A repository that claims to offer a pre-activated Kontakt 8 setup for Windows, but its README instructs users to run an obfuscated PowerShell script from an external domain, a pattern typical of malware distribution.

Early signalOther≈ +346 stars by the end of the day
5.7
Staplearhide/microstation-2026
The repository offers a "pre-activated" Microstation 2026 build for Windows x64 and instructions to install it by piping a PowerShell script from an external domain. It contains no source code and is effectively a lure…

Early signalSecurity≈ +346 stars by the end of the day
5.7
StellarPigeon/movavi-converter
The repository poses as a pre-activated Movavi Converter installer for Windows but actually instructs users to run a third-party PowerShell script from an external domain. This is a classic malware distribution scheme…

Early signalSecurity≈ +346 stars by the end of the day
5.7
stormdreamfoyer/movavi-photo-editor
The repository poses as a pre-activated Movavi Photo Editor build for Windows, but actually instructs users to run a third-party PowerShell script from an external domain. This is a typical malware distribution scheme…

Early signalSecurity≈ +344 stars by the end of the day
5.7
SwimmerRestore/on1-photo-raw-max
The repository poses as a pre-activated On1 Photo Raw Max build for Windows, but is actually an instruction to run a third-party PowerShell script from an external domain. It is a classic malware distribution scheme…

Early signalSecurity≈ +346 stars by the end of the day
5.7
wquguru/cicada
A macOS app that provides live bilingual subtitles, simultaneous interpreting and structured meeting notes for any call or stream by capturing system audio and running speech recognition locally.

PeakingProductivity & self-hostedSwift≈ +257 stars by the end of the day
5.7
zortos293/Lichii
Experimental Nintendo Switch 2 emulator in C++, a fork of Eglantine with memory leak fixes, speed improvements and support for more games.

PeakingGames & graphicsC++≈ +844 stars by the end of the day
5.6
orailnoor/cross-platform-llm-client
Cross-platform Flutter chat client that runs GGUF models locally on Android/iOS via llama.cpp and falls back to OpenAI, Anthropic, Gemini or Kimi cloud APIs. Chats and keys stay on-device.

BreakoutAppsC++≈ +139 stars by the end of the day
5.6
voyager-so/vork
Headless 3D and VFX engine in Rust and Slang with Vulkan and Metal rendering, designed for AI agents to author and iteratively refine scenes as code. Research preview.

Early signalGenerative mediaRust≈ +161 stars by the end of the day
5.6
vsmutok/FuckCaptcha
Open field guide to 39 CAPTCHA types: identification signals, free and open-source bypass methods, and paid alternatives, with a searchable web version. Intended for education and authorized research.

Early signalSecurityHTML≈ +80 stars by the end of the day
5.5
ranxianglei/billion-context
A context-compression proxy plugin between a coding agent and the model API: folds conversation history into layered summaries, saves tokens, and lets a single session run for months within a small context window.

BreakoutAI agentsTypeScript≈ +488 stars by the end of the day
5.4
Roland0511/dsh-marktext
A DeepSeek Harness plugin that embeds MarkText's editor core (muya) in the right sidebar, opening .md files as a finished WYSIWYG document with tables, math and diagrams. Saves are protected by a file version guard.

Early signalProductivity & self-hostedJavaScript≈ +141 stars by the end of the day
5.3
dmunozv04/iSponsorBlockTV
Self-hosted app that connects to YouTube TV clients and automatically skips SponsorBlock segments and mutes or skips YouTube ads.

BreakoutProductivity & self-hostedPython≈ +148 stars by the end of the day
5.3
NVIDIA/auto-ontology
NVIDIA's Python framework that builds a semantic ontology graph over enterprise metadata, giving LLM agents trusted metric and entity definitions for reliable text-to-SQL.

PeakingLanguage modelsPython≈ +569 stars by the end of the day
5.3
qybaihe/bla
BLA (Blind LLM Agents) is a defensive tool that poisons release artifacts (binaries, Electron/ASAR, JS bundles, Python, WASM, models, SQLite) so AI reverse-engineering agents hit resource budgets, follow decoys, and…

BreakoutSecurityTypeScript≈ +718 stars by the end of the day
5.3
storytold/craft-anything
A pure-Rust reverse-engineering engine with 284 tools that inspects websites, apps and games, then has a coding agent rebuild a similar version and checks the result against the original.

PeakingAI agentsRust≈ +1,477 stars by the end of the day
5.2
AtomIllusionistDwell/watson-username-footprint-finder
A free desktop people-search application. It checks usernames, emails, or phone numbers across over 3,100 public sources and generates a readable digital footprint report.

Early signalAppsTypeScript≈ +129 stars by the end of the day
5.2
google/skills
A collection of Agent Skills for Google products and technologies, including Google Cloud: ready-made instructions and workflows installed into AI agents via npx skills add.

PeakingAI agentsPython≈ +151 stars by the end of the day
5.2
graealex/WaveDudeNext
A 2D wave optics simulator for Windows: place light sources and optical parts on a canvas and watch waves refract, diffract and interfere, with field and intensity views, probes and video export.

Early signalScience & researchC#≈ +57 stars by the end of the day
5.2
Unleash/unleash
Open-source feature management platform for controlling feature flags across environments, enabling gradual rollouts, canary releases and kill switches without redeploying. Supports 15+ official SDKs for any language…

BreakoutDeveloper toolsTypeScript≈ +72 stars by the end of the day
5.1
Anil-matcha/Open-Generative-AI
Open-source image and video generation studio with 400+ models (Flux, Midjourney, Kling, Sora, Veo), no content filters, self-hosted with desktop builds.

BreakoutGenerative mediaJavaScript≈ +268 stars by the end of the day
5.1
anthropics/skills
A collection of Agent Skills examples for Claude: folders of instructions, scripts, and resources the model loads dynamically for specialized tasks. Includes the spec, a template, and production document skills for…

BreakoutAI agentsPython≈ +774 stars by the end of the day
5.1
morluto/rea
A reverse-engineering tool that lets AI agents inspect apps and native binaries: it connects agents to Hopper or Ghidra via MCP and CLI, helping explain how a feature works and rebuild it in your own project.

SteadyAI agentsTypeScript≈ +2,216 stars by the end of the day
5.0
ccch1mneyyy/dsh-Go
Unofficial Android client for DeepSeek Harness: runs DSH on the phone in a built-in Linux environment without root or Termux, and can also remotely control DSH on your computer.

PeakingAI agentsDart≈ +1,110 stars by the end of the day
4.9
chadyi/StudyOnTV
Android app for tablets, phones and TVs where kids unlock screen time by answering questions. Runs fully on-device: no server, no account, parents manage via QR code on the LAN.

Early signalAppsKotlin≈ +95 stars by the end of the day
4.9
egoist/mygo-music
A native desktop music player written in Go that plays local files with tags, covers and .lrc lyrics, and extends its features through JavaScript plugins.

Early signalAppsGo≈ +120 stars by the end of the day
4.9
google/elephant-goldfish-model
A plugin for coding agents (Antigravity, Claude Code, Codex) that helps design software: an elephant agent with project context drafts a specification, while fresh zero-context goldfish subagents review it for hidden…

SteadyAI agentsPython≈ +1,040 stars by the end of the day
4.9
GyulyVGC/sniffnet
Cross-platform Rust application for monitoring network traffic: pick an adapter, apply filters, view statistics, host geolocation, identify services and programs generating traffic. Supports PCAP import/export, IP…

BreakoutSecurityRust≈ +112 stars by the end of the day
4.9
pingdotgg/t3code
T3 Code is an agent harness control surface for agents on your machine, with mobile (iOS, Android), web and Electron desktop apps. It works with your Claude Code, Codex, Cursor, Grok Build, OpenCode and Google…

SteadyAI agentsTypeScript≈ +974 stars by the end of the day
4.8
anthropics/claude-quickstarts
A collection of starter projects from Anthropic showing how to build applications on the Claude API: support agents, data analysis, browser and desktop automation, autonomous coding agents.

BreakoutAI agentsPython≈ +332 stars by the end of the day
4.8
gosom/google-maps-scraper
Open-source Google Maps scraper written in Go that extracts business names, addresses, phones, websites, emails, ratings, reviews and coordinates via CLI, Web UI or REST API.

BreakoutData & analyticsGo≈ +172 stars by the end of the day
4.8
zed-industries/zed
A high-performance code editor with real-time multiplayer collaboration, written in Rust by the creators of Atom and Tree-sitter. Available for macOS, Linux, and Windows.

PeakingDeveloper toolsRust≈ +127 stars by the end of the day
4.7
Beatzolattice/anyunlock
The repository offers a "pre-activated" build of the Anyunlock utility for Windows x64, installed via a PowerShell script from an external domain. It is essentially instructions to run an unverifiable installer rather…

Early signalSecurity≈ +347 stars by the end of the day
4.7
CartwrightHammer/aomei-backupper
The repository offers a "pre-activated" Aomei Backupper build for Windows and instructions to run a PowerShell script from an external domain. It contains no source code and is effectively a lure to download and…

Early signalSecurity≈ +347 stars by the end of the day
4.7
CityFiremanWave/fonepaw-unlocker
The repository poses as a pre-activated Fonepaw Unlocker build, but actually distributes a malicious PowerShell script disguised as an installer.

Early signalSecurity≈ +347 stars by the end of the day
4.7
crmne/zapfast
A native WhatsApp desktop client written in Rust with egui, linking to your phone as a companion device without a browser engine. It runs on Linux, macOS and Windows with low memory use and local encrypted chat storage.

PeakingAppsRust≈ +145 stars by the end of the day
4.7
ExcellenceSavior/iobit-driver-booster
The repository poses as a pre-activated Iobit Driver Booster build, but in practice it is an instruction to run a third-party PowerShell script from an external domain with administrator rights. This is a classic…

Early signalSecurity≈ +347 stars by the end of the day
4.7
Exteriordadynamo/metatrader-5-bot
Repository offers a "pre-activated" MetaTrader 5 Bot build for Windows x64, distributed via a PowerShell command that downloads a script from an external domain. The README does not describe the bot's functionality,…

Early signalOther≈ +347 stars by the end of the day
4.7
FaceAttorney/rust-external-trainer-tool
The repository poses as a Rust External Cheat installer, but is essentially a downloader script: the README instructs running a PowerShell command that fetches and executes a remote file from an external domain. It…

Early signalSecurity≈ +347 stars by the end of the day
4.7
falsekomodohex/sketchup-pro
Repository offers a "pre-activated" Sketchup Pro 2023 build for Windows x64, distributed via a PowerShell script from an external domain. It is not an official Sketchup installer nor an open-source project.

Early signalSecurity≈ +347 stars by the end of the day
4.7
FangSongBang/solidworks-cad
The repository poses as a pre-activated SolidWorks CAD 2026 build but actually instructs users to run a third-party PowerShell script from an external domain. This is a classic malware distribution scheme disguised as…

Early signalSecurity≈ +347 stars by the end of the day
4.7
milind-soni/OpenMausBot
,

PeakingAI agentsTypeScript≈ +948 stars by the end of the day
4.7
Outsideclofilter/aion-2-trainer-tool
The repository poses as a cheat tool for the game Aion 2, but actually instructs users to run a PowerShell command that downloads and executes a script from an external domain. This is a classic malware distribution…

Early signalSecurity≈ +347 stars by the end of the day
4.7
ParakeetWatch/adobe-audition
The repository poses as an installer for the Adobe Audition audio editor but actually instructs users to run a PowerShell command that downloads a script from an external domain. This is a classic malware distribution…

Early signalSecurity≈ +347 stars by the end of the day
4.7
Perceptionnehandcuff/archicad
Archicad 2026 automated deployment pipeline for professional desktop software utility configuration, ensuring seamless local workstation deployment.

Early signal≈ +347 stars by the end of the day
4.7
phantomsociallook/auslogics
A repository that claims to offer a pre-activated Auslogics build for Windows, but its README only contains instructions to run a remote PowerShell script from an unrelated domain, which is a common malware…

Early signalOther≈ +346 stars by the end of the day
4.7
PugilistCarve/cinebench
The repository poses as a pre-activated Cinebench build, but it is actually a script that downloads and runs third-party PowerShell code from an external domain under the guise of an installer. The real Cinebench…

Early signalSecurity≈ +347 stars by the end of the day
4.7
Radianfeintroduce/data-grip
A pre-configured Data Grip environment for deploying desktop utilities. Allows using the program without registration or license settings.

Early signalDeveloper tools≈ +347 stars by the end of the day
4.7
resonancemouserescue/discord-server-raider
The repository poses as a Discord server raiding tool, but is essentially a phishing lure: the README instructs users to run a PowerShell command that downloads and executes a script from an external domain disguised…

Early signalSecurity≈ +347 stars by the end of the day
4.7
RestAlbatrossStride/fabfilter-total
A repository that claims to offer a pre-activated Fabfilter Total bundle for Windows, but its README instructs users to run an obfuscated PowerShell script from an external domain, a pattern typical of malware…

Early signalOther≈ +346 stars by the end of the day
4.7
savagesectorpattern/exitlag
Repository hosting a pre-activated Exitlag build for Windows x64: one-command PowerShell install without registration or license setup.

Early signalApps≈ +347 stars by the end of the day
4.7
Sentrylyadefeat/foneazy-mobile
A repository that claims to offer a pre-activated Foneazy Mobile build for Windows x64, but its README only contains instructions to run a remote PowerShell script from an unrelated domain. This is a classic malware…

Early signalOther≈ +347 stars by the end of the day
4.7
SettlementCourse/genesis-miner
This repository distributes a disguised malicious PowerShell loader masquerading as a pre-activated cryptocurrency miner, with no actual mining or development code.

Early signalSecurity≈ +347 stars by the end of the day
4.7
sheenhunterdeflate/hitfilm
Repository offers a "pre-activated" Hitfilm setup for Windows x64 via a PowerShell script fetched from an external domain, promising use without registration or license.

Early signalSecurity≈ +347 stars by the end of the day
4.7
Silentapstare/imei-repair
The repository offers a "pre-activated" IMEI Repair setup for Windows x64 by running a PowerShell script from an external domain. It is essentially not a tool but instructions to download and execute third-party code.

Early signalSecurity≈ +347 stars by the end of the day
4.7
SleuthPropagate/imobie-anytrans
A repository that claims to offer a pre-activated Imobie Anytrans package for Windows, but its README only contains instructions to run an obfuscated PowerShell script from an external domain, which is a malware…

Early signalOther≈ +347 stars by the end of the day
4.7
spheretaxiname/melodyne-5
The repository poses as a pre-activated Melodyne 5 build for Windows, but is essentially instructions to run a third-party PowerShell script from an external domain. This is a classic malware distribution scheme…

Early signalSecurity≈ +345 stars by the end of the day
4.7
StadiumSensei/microsoft-visio
The repository poses as a pre-activated Microsoft Visio 2026 build for Windows, but it is actually a script that downloads and runs third-party PowerShell code from an external domain. There is no legitimate Visio…

Early signalSecurity≈ +347 stars by the end of the day
4.7
Teralunapick/power-director
A repository that claims to offer a pre-activated Power Director 2026 build for Windows, but its README only provides instructions to run an obfuscated PowerShell script from an external domain, which is a common…

Early signalOther≈ +347 stars by the end of the day
4.7
Thornthedefine/reason-14
A repository that claims to offer a pre-activated Reason 14 installer for Windows, but its README only contains instructions to run an obfuscated PowerShell script from an external domain, which is a common malware…

Early signalOther≈ +347 stars by the end of the day