Here's a thread on who's sending your contacts out: NOIR gained 2,700 stars in 6 days

A young developer in Beijing built a small tool that runs on a computer: plug your phone into USB, and it lists which permissions each app has and which reporting domains are hidden in the APK. It went from zero to 2,700 stars in 6 days. It wasn't the new features that did it; three things came together: the sentiment that "domestic phones steal data," the adb wave of open-source projects "using adb to clean up domestic phones" from the previous two weeks, and one real-device screenshot. Below I explain how it took off, and which steps to copy if you want a project that gets the same stars.

A screenshot of a Xiaomi 17 Pro Max

On 2026 Oct 31 (UTC), X user "Bai Yuhe" (@Verlintas) posted: "Just had Dafeiyu check my Xiaomi 17 Pro Max, and guess what..." with two screenshots of the scan results attached, but no link.

On 21:34 (UTC, already early morning Nov 1 in Beijing), he created the NOIR repo on GitHub. 12 minutes later he posted the official announcement: "I built an audit tool: NOIR", with the repo link. That post later got 72.5k views and about 665 bookmarks. His GitHub profile says "Born 2010", Beijing, Android/Kotlin developer, and his best previous project had only 128 stars. So this wasn't carried by an existing following.

What it actually does

NOIR is a command-line tool written in Kotlin that runs on Mac, Windows, and Linux. The first line of the README reads: "Turn 'what can this phone actually leak' into a reproducible report."

What it does, in order:

• Lists every app that can reach the network and has sensitive permissions;
• Extracts URLs from each APK on the phone and sends only the few-KB result back to your computer;
• identifies vendors (Xiaomi, Tencent, AMap...) and categories (telemetry, ads, location, input method...) by package name and domain, and scores the risk;
• translates permissions into "what data it can access" (location, contacts, SMS, microphone...), pairs them with reporting domains, and concludes "which data may flow where";
• gives remediation advice in three tiers: "can do automatically", "needs your confirmation", "don't touch", with a rollback command attached to every item.

No internet access, no root needed, nothing uninstalled by default. Run without arguments and it opens a wizard: if adb isn't installed it asks whether to download it automatically, if no phone is plugged in it walks you through enabling USB debugging step by step, then waits for you to connect. The whole flow asks only two or three y/n questions.

Note that this is static analysis: a domain appearing in an APK only means data "may" be sent there, not that it actually was. How many false positives there are, nobody has tested yet.

6 day gain

Source: GitHub daily star records and the GitHub API, data as of 11-06.

It's not just starring: Releases have been downloaded about 9,985 times in total (GitHub API, 11-06), with 14 versions shipped over 6 days, from v0.1.0 to v0.4.1, all committed by one author. The fork-to-star ratio is about 9%, similar to new projects of the same size, with no sign of star-botting. The stargazer breakdown wasn't pulled, though, so that can't be fully ruled out.

Where the stars came from: one line saying "told you not to use domestic Chinese phones"

The author's own post brought the first wave, and 11-02 had already gathered 219 stars before that. The real spark was on Nov 2 (UTC 05:13), when the big Chinese tech account @geekbb posted:

"I've always told you not to use domestic Chinese phones and you didn't listen. Go check who's sending your location and contacts out. Plug in USB and run an adb scan, and you'll get a list with domains and rollback commands."

That post got 154k views, and the next day it added 998 stars in a single day. Then came a string of reposts with the same pitch: @Lee_points "Using a domestic Android phone to get over the wall? Scan your phone with adb", @NFTCPS "This could be made into an anti-spy tool", @chuanliang wrote a long post "Which apps might be secretly sending your data?", @Suu766 "Android users who get over the wall really need to watch phone privacy". Further out, security forums like T00ls, Telegram channels, Japanese note.com, and Russian- and Portuguese-language AI news sites passed it along, mostly framed as "how to check your phone for spyware". Finally a batch of auto-repost accounts on Instagram, Facebook, and YouTube Shorts called it "an open-source alternative to Exodus Privacy".

What's missing: no posts on HN, Reddit, or V2EX, and no mainstream media coverage. It also couldn't land on GitHub trending, since trending doesn't include repos younger than 60 days. The whole thing spread almost entirely within one circle of Chinese-language X.

The two lines people kept quoting were: "plug in one cable and you can see who's sending your location and contacts" and "every remediation step comes with a rollback command". Nobody was comparing its accuracy against established tools.

Why this week: adb had just taught a lot of people

NOIR didn't come out of nowhere. In mid-to-late October, GitHub was full of projects that cleaned up Android devices with adb and no root:

• Gathin23/cleanyourtv, created 10-17, cleans Android / Google TV, reached 52,550 stars, peak single-day +7,120;
• pengchujin/aerial-tv, 10-20, gives domestic Chinese TVs a clean home screen, 9,951 stars;
• rddmwmddr/android-ad-cleaner, 10-24, "turns off ads in the system of domestic Android phones... no root, reversible", 6,537 stars, 10-28 with +2,002 in a single day;
• followed by a string of others like free-my-tv, dumbtv, and tv-detox.

(GitHub daily star records, data as of 11-06)

That wave taught many ordinary users to "enable USB debugging, plug in, run a script, and it's reversible", and it got Chinese tech accounts into the habit of reposting projects like this. NOIR came out a week later with a different angle: from "remove ads" to "who is stealing my data". The emotion is stronger, with domestic phones, getting over the wall, and contacts being exfiltrated all in the mix; and its users are exactly the people who had just learned to use adb, so there's almost no re-education needed.

There's also the other side: each new project in this wave has a lower ceiling than the last, 52,000, 9,900, 6,500, 2,700. The same people were hit with the same kind of project for three weeks, and the novelty is wearing off (inference).

Who's already doing this

Functionally NOIR isn't new. There are plenty of older projects with more stars:

(star counts from GitHub, 11-06)

The last row says it best: projects from the same year with the same idea, without that screenshot and that line, sit at a few dozen stars. The built-in system privacy panel only tells you what an app "can read", not where it "sends it", and that gap is what NOIR sells.

Others have already followed: anthonyonazure/NOIR is an English translation, there's a mirror on gitcode, and among the 255 forks there's NOIR-android, which wants to port it to the phone. The idea site Nichr wrote up this direction in 11-04 as "turning the Android cleanup CLI into a privacy app for ordinary people".

What it got right

1. Post the screenshot first, the link second. The first tweet was just the real-device result and a "guess what", building suspense; the formal post with the link only went up 12 minutes after the repo was created.
2. A line a big account will pick up. The tool itself is neutral; "who's sending your location and contacts out" is the sentence that spreads. Adding @geekbb's "told you not to use domestic phones" lit the emotion.
3. Make it safe for people to repost. A portable package that runs with a double-click, adb downloaded automatically, step-by-step USB debugging guidance, errors that only tell you what to do next, every action reversible, read-only by default. Big accounts were willing to push it because nobody would come back angry that their phone got broken (inference).
4. The report looks good. The terminal dashboard is polished enough to screenshot and share, and every reposter was advertising it for free.
5. Fast release cadence. 14 versions in 6 days, so anyone who came by saw an active project, and downloads kept climbing.

The difference that actually mattered was the format of "a report an ordinary person can understand", not the detection technology.

If it were you

B: worth a try. What you can copy is the format: "device + who's spying on me + a report you can screenshot", not building another Android scanner. The adb wave has already run three weeks, and later entrants are getting fewer and fewer stars, and you'd still need a big account willing to repost you.

Who it suits: developers who know adb, APK reverse engineering, or low-level tooling for a particular platform; who have a device they can "dissect" to get a striking scan result; who have some presence on Chinese X or in a tech circle, or at least know who to hand the thing to.

Who it doesn't suit: anyone who wants to build yet another "Android phone privacy scanner". NOIR has already taken that spot, with an English translation, a mirror, and a phone-version fork all out there, so no matter how good yours is, it'll read as a copycat. It also doesn't suit people who can write code but can't come up with the one line that gets reposted: adbauditor, the same idea from the same year, has only 85 stars.

How to do it: switch the device or the audience, and do the same thing. A few directions (all inferences, none verified as to whether someone has already built them):

• TVs: the earlier cleanup projects proved there are TV users. Moving from "clean up the home screen" to "where is this TV sending data" is exactly the step NOIR took for phones;
• car systems, smart speakers, routers, and Windows preinstalled software, the same kind of "leak audit";
• English-speaking audiences: Western users don't have the "domestic Chinese phone" emotion, but smart TVs tracking viewing via screen recognition and tracking SDKs have long been staples of privacy circles. The hook would have to be rewritten in their terms.

Build the product in NOIR's image: read-only by default, every action reversible, runs with a double-click, has a wizard, produces a report you can understand from a screenshot, and has a bilingual Chinese-English README.

How to get users: first scan your own device, pick the most striking result, post the screenshot without the link; post the formal tweet the same day you create the repo, and make the first sentence clear: "plug in a cable and see where X is sending Y". Chinese tech accounts on X and circumvention circles are most receptive to this, with security forums like T00ls and Telegram channels as the second wave. Ship a release every day for the first few days after posting.

When to launch: before late November (inference). This wave runs on novelty. Once people are tired of "plug in and scan", the same thing only gets a few dozen stars.

Signs you've misread it:

• The following week, NOIR's daily additions drop to double digits, and new projects in the same category get no big-account reposts: the wave has receded, and jumping in now is too late;
• Conversely, if mainstream media covers it, or a phone maker responds about the domains NOIR flagged, the issue moves from an in-circle topic to a public one. The window is bigger than it looks, and it's more worth doing;
• If Google or phone makers tighten USB debugging and adb can access less, this category of tool gets a narrower path.