# Here's a thread on who's sending your contacts out: NOIR gained 2,700 stars in 6 days · GitHub open-source project

> Source: https://stringers.io/en/github/gh_Verlintas__NOIR.html (Stringers / 什么值得做, generated 2026-11-08)
> Stringers answers one question every day: what small product can one or two people build in a few months and actually make money from. Numbers come from 15 databases we collect daily, each with source and date.
> For agents: these verdicts and the underlying databases (verified revenue, App Store / Google Play charts, ad libraries, GitHub, Product Hunt…) are queryable live over MCP — tools today / hot / products / directions / direction / data. Setup: https://github.com/komako-workshop/stringers (the user logs in at stringers.io → "配置 agent" to get a personal URL). Site index: https://stringers.io/llms.txt

> The author teased it by posting a scan screenshot of their own Xiaomi phone. The Chinese tech influencer @geekbb added a line, "I always told you not to use domestic phones," which got 150k views and nearly a thousand stars the next day. The open-source wave of the previous two weeks, cleaning domestic phones and TVs with adb, had already taught plenty of people to plug in a cable and run a script.

[GitHub open-source project](https://stringers.io/en/github/index.md) · written 11-6

Verlintas/NOIR · Verlintas

# Here's a thread on who's sending your contacts out: NOIR gained 2,700 stars in 6 days

**What it is** A command-line tool that runs on your computer. Plug in your phone, and it tells you what data each app can access, where it might send it, and gives you ways to revoke it.

**Why it took off** The author first posted a scan screenshot of his Xiaomi phone to build suspense. The Chinese tech account @geekbb replied "I always told you not to use domestic phones," which got 150k views, and it gained nearly a thousand stars the next day. The adb cleanup wave for domestic phones and TVs over the previous two weeks had already taught many people to plug in and run scripts.

**B** **How you can follow** Don't build another Android scanner. Instead, apply the same "leak audit" to other devices or audiences (TVs, car systems, routers, the English-speaking market). Match its format: one-click run, rollback, and a shareable report. Post real-device screenshots first, then the link.

Grade B: the path to follow is clear, and the same format can be moved to other devices and audiences. But the adb wave has been going for three weeks, later entrants get fewer stars each time, and whether it takes off depends on whether a big account is willing to repost it. Spreading within a small circle

Data (updated daily) · repo created 2026-10-31 · 2,883 stars

GitHub · stars

Data 2026-11-02 → 2026-11-08 (7 days, 7 observations). Points before 10-28 come from deeply / archive backfill, not every day has one

A young developer in Beijing built a small tool that runs on a computer: plug your phone into USB, and it lists which permissions each app has and which reporting domains are hidden in the APK. It went from zero to 2,700 stars in 6 days. It wasn't the new features that did it; three things came together: the sentiment that "domestic phones steal data," the adb wave of open-source projects "using adb to clean up domestic phones" from the previous two weeks, and one real-device screenshot. Below I explain how it took off, and which steps to copy if you want a project that gets the same stars.

### A screenshot of a Xiaomi 17 Pro Max

On 2026 Oct 31 (UTC), X user "Bai Yuhe" (@Verlintas) posted: "Just had Dafeiyu check my Xiaomi 17 Pro Max, and guess what..." with two screenshots of the scan results attached, but no link.

On 21:34 (UTC, already early morning Nov 1 in Beijing), he created the NOIR repo on GitHub. 12 minutes later he posted the official announcement: "I built an audit tool: NOIR", with the repo link. That post later got 72.5k views and about 665 bookmarks. His GitHub profile says "Born 2010", Beijing, Android/Kotlin developer, and his best previous project had only 128 stars. So this wasn't carried by an existing following.

### What it actually does

NOIR is a command-line tool written in Kotlin that runs on Mac, Windows, and Linux. The first line of the README reads: "Turn 'what can this phone actually leak' into a reproducible report."

What it does, in order:

- Lists every app that can reach the network and has sensitive permissions;

- Extracts URLs from each APK on the phone and sends only the few-KB result back to your computer;

- identifies vendors (Xiaomi, Tencent, AMap...) and categories (telemetry, ads, location, input method...) by package name and domain, and scores the risk;

- translates permissions into "what data it can access" (location, contacts, SMS, microphone...), pairs them with reporting domains, and concludes "which data may flow where";

- gives remediation advice in three tiers: "can do automatically", "needs your confirmation", "don't touch", with a rollback command attached to every item.

No internet access, no root needed, nothing uninstalled by default. Run without arguments and it opens a wizard: if adb isn't installed it asks whether to download it automatically, if no phone is plugged in it walks you through enabling USB debugging step by step, then waits for you to connect. The whole flow asks only two or three y/n questions.

Note that this is static analysis: a domain appearing in an APK only means data "may" be sent there, not that it actually was. How many false positives there are, nobody has tested yet.

### 6 day gain

| Date | star | fork |
|---|---|---|
| 10-31 | Repo created |  |
| 11-02 | 219 | 20 |
| 11-03 | 1,217 (+998 in a single day) | 88 |
| 11-04 | 1,741 | 129 |
| 11-05 | 1,997 | 165 |
| 11-06 | 2,436, later that day 2,703 | 222 / 255 |

Source: GitHub daily star records and the GitHub API, data as of 11-06.

It's not just starring: Releases have been downloaded about 9,985 times in total (GitHub API, 11-06), with 14 versions shipped over 6 days, from v0.1.0 to v0.4.1, all committed by one author. The fork-to-star ratio is about 9%, similar to new projects of the same size, with no sign of star-botting. The stargazer breakdown wasn't pulled, though, so that can't be fully ruled out.

### Where the stars came from: one line saying "told you not to use domestic Chinese phones"

The author's own post brought the first wave, and 11-02 had already gathered 219 stars before that. The real spark was on Nov 2 (UTC 05:13), when the big Chinese tech account @geekbb posted:

> "I've always told you not to use domestic Chinese phones and you didn't listen. Go check who's sending your location and contacts out. Plug in USB and run an adb scan, and you'll get a list with domains and rollback commands."

That post got 154k views, and the next day it added 998 stars in a single day. Then came a string of reposts with the same pitch: @Lee_points "Using a domestic Android phone to get over the wall? Scan your phone with adb", @NFTCPS "This could be made into an anti-spy tool", @chuanliang wrote a long post "Which apps might be secretly sending your data?", @Suu766 "Android users who get over the wall really need to watch phone privacy". Further out, security forums like T00ls, Telegram channels, Japanese note.com, and Russian- and Portuguese-language AI news sites passed it along, mostly framed as "how to check your phone for spyware". Finally a batch of auto-repost accounts on Instagram, Facebook, and YouTube Shorts called it "an open-source alternative to Exodus Privacy".

What's missing: no posts on HN, Reddit, or V2EX, and no mainstream media coverage. It also couldn't land on GitHub trending, since trending doesn't include repos younger than 60 days. The whole thing spread almost entirely within one circle of Chinese-language X.

The two lines people kept quoting were: "plug in one cable and you can see who's sending your location and contacts" and "every remediation step comes with a rollback command". Nobody was comparing its accuracy against established tools.

### Why this week: adb had just taught a lot of people

NOIR didn't come out of nowhere. In mid-to-late October, GitHub was full of projects that cleaned up Android devices with adb and no root:

- Gathin23/cleanyourtv, created 10-17, cleans Android / Google TV, reached 52,550 stars, peak single-day +7,120;

- pengchujin/aerial-tv, 10-20, gives domestic Chinese TVs a clean home screen, 9,951 stars;

- rddmwmddr/android-ad-cleaner, 10-24, "turns off ads in the system of domestic Android phones... no root, reversible", 6,537 stars, 10-28 with +2,002 in a single day;

- followed by a string of others like free-my-tv, dumbtv, and tv-detox.

(GitHub daily star records, data as of 11-06)

That wave taught many ordinary users to "enable USB debugging, plug in, run a script, and it's reversible", and it got Chinese tech accounts into the habit of reposting projects like this. NOIR came out a week later with a different angle: from "remove ads" to "who is stealing my data". The emotion is stronger, with domestic phones, getting over the wall, and contacts being exfiltrated all in the mix; and its users are exactly the people who had just learned to use adb, so there's almost no re-education needed.

There's also the other side: each new project in this wave has a lower ceiling than the last, 52,000, 9,900, 6,500, 2,700. The same people were hit with the same kind of project for three weeks, and the novelty is wearing off (inference).

### Who's already doing this

Functionally NOIR isn't new. There are plenty of older projects with more stars:

| Project | Starting point | star | How NOIR differs |
|---|---|---|---|
| Exodus Privacy | 2017 | App 1,053 | Matches store versions against the signatures of known tracking SDKs; NOIR scans the APKs actually installed on your phone, including the preinstalled system ones |
| TrackerControl | 2019 | 2,723 | Installed on the phone, does live blocking through a local VPN; NOIR runs once on your computer and produces a report |
| universal-android-debloater and its successors | 2021 / 2023 | 20,341 / 9,758 | Also uses adb with no root, focused on removing preinstalled apps from a list; NOIR focuses on the report |
| App Manager | 2020 | 9,459 | Full-featured package managers on the phone that can also show trackers, but with a high bar to entry and no "one-click report + rollback file" |
| MobSF / MVT | 2015 / 2021 | 22,146 / 15,747 | Professional security scanning and forensics that ordinary people can't use |
| adbauditor, android-privacy-hardener | 2026 | 85 / very few | Nearly the same idea, nobody pushed them, they didn't take off |

(star counts from GitHub, 11-06)

The last row says it best: projects from the same year with the same idea, without that screenshot and that line, sit at a few dozen stars. The built-in system privacy panel only tells you what an app "can read", not where it "sends it", and that gap is what NOIR sells.

Others have already followed: anthonyonazure/NOIR is an English translation, there's a mirror on gitcode, and among the 255 forks there's NOIR-android, which wants to port it to the phone. The idea site Nichr wrote up this direction in 11-04 as "turning the Android cleanup CLI into a privacy app for ordinary people".

### What it got right

1. **Post the screenshot first, the link second.** The first tweet was just the real-device result and a "guess what", building suspense; the formal post with the link only went up 12 minutes after the repo was created.

2. **A line a big account will pick up.** The tool itself is neutral; "who's sending your location and contacts out" is the sentence that spreads. Adding @geekbb's "told you not to use domestic phones" lit the emotion.

3. **Make it safe for people to repost.** A portable package that runs with a double-click, adb downloaded automatically, step-by-step USB debugging guidance, errors that only tell you what to do next, every action reversible, read-only by default. Big accounts were willing to push it because nobody would come back angry that their phone got broken (inference).

4. **The report looks good.** The terminal dashboard is polished enough to screenshot and share, and every reposter was advertising it for free.

5. **Fast release cadence.** 14 versions in 6 days, so anyone who came by saw an active project, and downloads kept climbing.

The difference that actually mattered was the format of "a report an ordinary person can understand", not the detection technology.

### If it were you

**B: worth a try.** What you can copy is the format: "device + who's spying on me + a report you can screenshot", not building another Android scanner. The adb wave has already run three weeks, and later entrants are getting fewer and fewer stars, and you'd still need a big account willing to repost you.

**Who it suits** : developers who know adb, APK reverse engineering, or low-level tooling for a particular platform; who have a device they can "dissect" to get a striking scan result; who have some presence on Chinese X or in a tech circle, or at least know who to hand the thing to.

**Who it doesn't suit** : anyone who wants to build yet another "Android phone privacy scanner". NOIR has already taken that spot, with an English translation, a mirror, and a phone-version fork all out there, so no matter how good yours is, it'll read as a copycat. It also doesn't suit people who can write code but can't come up with the one line that gets reposted: adbauditor, the same idea from the same year, has only 85 stars.

**How to do it** : switch the device or the audience, and do the same thing. A few directions (all inferences, none verified as to whether someone has already built them):

- TVs: the earlier cleanup projects proved there are TV users. Moving from "clean up the home screen" to "where is this TV sending data" is exactly the step NOIR took for phones;

- car systems, smart speakers, routers, and Windows preinstalled software, the same kind of "leak audit";

- English-speaking audiences: Western users don't have the "domestic Chinese phone" emotion, but smart TVs tracking viewing via screen recognition and tracking SDKs have long been staples of privacy circles. The hook would have to be rewritten in their terms.

Build the product in NOIR's image: read-only by default, every action reversible, runs with a double-click, has a wizard, produces a report you can understand from a screenshot, and has a bilingual Chinese-English README.

**How to get users** : first scan your own device, pick the most striking result, post the screenshot without the link; post the formal tweet the same day you create the repo, and make the first sentence clear: "plug in a cable and see where X is sending Y". Chinese tech accounts on X and circumvention circles are most receptive to this, with security forums like T00ls and Telegram channels as the second wave. Ship a release every day for the first few days after posting.

**When to launch: before late November** (inference). This wave runs on novelty. Once people are tired of "plug in and scan", the same thing only gets a few dozen stars.

**Signs you've misread it** :

- The following week, NOIR's daily additions drop to double digits, and new projects in the same category get no big-account reposts: the wave has receded, and jumping in now is too late;

- Conversely, if mainstream media covers it, or a phone maker responds about the domains NOIR flagged, the issue moves from an in-circle topic to a public one. The window is bigger than it looks, and it's more worth doing;

- If Google or phone makers tighten USB debugging and adb can access less, this category of tool gets a narrower path.

[GitHub repo ↗](https://github.com/Verlintas/NOIR)

**Research notes: competitor table, acquisition evidence, full research report**

Competitors

| Name | Where | Launched | Scale | How it differs from this one |
|---|---|---|---|---|
| Exodus Privacy | Open source | 2017-2018 | exodus 814 star,Android App 1,053 star | Exodus matches stored-app tracker SDK signatures; NOIR scans the APKs actually installed on your phone (preinstalled ones included), pulls every URL out, sorts them by Chinese OEM, pairs them with permissions, and gives you reversible removal actions |
| TrackerControl | Open source | 2019 | 2,723 star | It intercepts in real time on the phone through a local VPN; NOIR is a one-off, static audit report run from a computer |
| universal-android-debloater / UAD-NG | Open source | 2021 / 2023 | 20,341 / 9,758 star | Also uses adb and no root, but UAD is mainly about uninstalling preinstalled apps from a list; NOIR is about an audit report that traces permissions → data → domains |
| rddmwmddr/android-ad-cleaner | Open source | 2026-10-24 | 6,537 stars, peaking at +2,002 in a single day | It turns off ads and push notifications on Chinese phones; NOIR covers data leakage, the next pain point for the same users |
| App Manager | Open source | 2020 | 9,459 star | A full-featured package manager that runs on the phone and can also show trackers; no one-click report or rollback file, so the bar is higher |
| MobSF / MVT | Open source | 2015 / 2021 | 22,146 / 15,747 star | Professional security scanning / forensics tools; NOIR packages similar capability into a version an ordinary person can run by double-clicking |
| System privacy dashboard / permission manager | Big-company features | - | All Android users | Only tells you what an app can read, not where the data is sent |
| adbauditor / android-privacy-hardener | Open source | 2026 | 85 stars / not yet indexed | Similar idea, but nobody is promoting it, and it isn't usable by ordinary people |

Where users come from

- **Verified** **The author posted on X himself (real-device screenshot teaser + formal tweet)** : x.com/Verlintas/status/2116648085174825344, posted 12 minutes after the repo was created, 72.5K views, about 665 bookmarks; the previous post was a scan screenshot teaser from a Xiaomi 17 Pro Max

- **Verified** **Chinese tech X big account reposted it (the tipping point)** : @geekbb, 11-02 05:13 UTC, "I always tell you not to use Chinese phones…", 153.6K views; the next day 11-03 gained +998 stars in a single day (github repo)

- **Verified** **Copycat repost accounts / circumvention circles / long-form posts** : @Lee_points (11-02), @NFTCPS (11-03), @chuanliang long post (11-04), @Suu766 (11-04)

- **Verified** **Security forums and Telegram channels** : T00ls articles-75676 (11-05), tg.okhk.net/posts/11922 (11-02)

- **Verified** **Overseas reposts + content farms / auto-repost accounts** : note.com Japanese tutorial (sourced from geekbb), ai-release in Russian, novidadesia in Portuguese; Instagram reels, Facebook githunt, YouTube Shorts, gitdiagram, trendshift

- **Verified** **Domestic open-source platform endorsement / distribution** : README carries AtomGit G-Star badge and mirror; AUR has community package noir-audit-bin

- Inferred **GitHub trending** : repo created less than 60 days ago, trending doesn't count it, so it is not a source

## Verlintas/NOIR: why it hit 2400+ stars in 6 days

> Research date 2026-11-06. Data sources: our github database (repo_profile / repo_day, as of 2026-11-06), GitHub API (checked live that day), Jina/Exa/Brave search and page text.

### Bottom line

NOIR is a desktop command-line tool. Through adb it inventories which permissions each app on an Android phone has, which reporting domains are hidden in the APKs, and then offers reversible removal actions. It took off because of **the Chinese X circle's sentiment that Chinese Android phones steal data, plus the open-source wave of 'adb, no-root cleanup of Chinese phones / TVs' from late October** , and was ignited by a real-device scan screenshot of a Xiaomi 17 Pro Max. The author's own tweet (72.5K views) started it, and @geekbb's line 'I always tell you not to use Chinese phones' (154K views) was the real tipping point, followed by a string of Chinese tech accounts and content farms. The product itself is complete (a portable package that runs with a double-click, a wizard, bilingual Chinese and English, and a rollback command for every action), which is why it could capture this traffic, but it is not new in terms of features.

### 1. Data

| Date | star | fork | Stars gained that day | Source |
|---|---|---|---|---|
| 2026-10-31 21:34 UTC | Repo created |  |  | GitHub API |
| 2026-11-02 | 219 | 20 |  | github repo_day |
| 2026-11-03 | 1217 | 88 | +998 (peak) | Same as above |
| 2026-11-04 | 1741 | 129 | +524 | Same as above |
| 2026-11-05 | 1997 | 165 | +256 | Same as above |
| 2026-11-06 | 2436 | 222 | +439 | Same as above |
| 2026-11-06 checked live that day | 2703 | 255 |  | GitHub API |

- Fork/star ratio about 9%, roughly the same as the median for new repos of similar size (about 11%). The author has 32 public repos and 2026-07 registration, so it's not a new account with a single repo; the suspect column in the database is empty. I see no sign of star farming (the stargazer detail endpoint could not be queried that day, unverified).

- **People are really downloading and using it** : Releases total about 9,985 downloads (v0.2.5 4,015 downloads, v0.2.6 3,261 downloads, v0.2.4 1,291 downloads…, GitHub API 2026-11-06). 6 versions shipped in 14 days (v0.1.0 → v0.4.1), and the author alone made 32 commits.

- Author Verlintas (called 'Bai Yuhe' on X). The GitHub profile says 'Born 2010', based in Beijing, an Android/Kotlin/AI developer. The previous best repo, BetterAIChat, had only 128 stars, so this wasn't driven by an existing following.

### 2. Where users came from (by time)

| Time (UTC) | Channel | Evidence | Impact |
|---|---|---|---|
| 10-31 | The author posts a teaser first | @Verlintas "Just had @dayufish check my Xiaomi 17 Pro Max, and guess what..." + scan screenshot | Real-device results used to build anticipation |
| 10-31 21:46 (12 minutes after the repo was created) | Author's formal tweet | x.com/Verlintas/status/2116648085174825344:72.5K views, about 393 likes, 665 bookmarks | First wave: reached 11-02 stars within 219; v0.2.4 had already been downloaded 1,291 times by then |
| 11-02 05:13 | **@geekbb (Geek, a Chinese tech big account)** | x.com/geekbb/status/2117122916672475502: "I always tell you not to use Chinese phones, and you don't take it seriously. Go check who is sending your location and contacts out…", 153.6K views | **The tipping point** , gained 998 stars the next day |
| 11-02 | @Lee_points | "Please listen to me, I told you long ago not to use Chinese Android phones to get over the wall. Run adb over your phone once" (transcribed by bittide.aicompass.dev) | The same script spread along with it |
| 11-02 | Telegram channel OKHK | tg.okhk.net/posts/11922 | Chinese TG circles |
| 11-03 01:20 | @NFTCPS (Bird Brother / Bluebird Club) | "This can already be used as an anti-spyware tool, just plug in a data cable and you can check…" | Traffic-riding repost accounts |
| 11-03 | Japanese note.com (sourced from geekbb's post), Russian ai-release, Portuguese novidadesia, Japanese/Korean hdatf | Tutorials framed as 'checking for spyware' | Spread overseas |
| 11-03~04 | Chinese AI navigation sites, SEO sites | zuphp, fengdaoai, nav.useaiwriter, aifrontierpost, etc. | long tail |
| 11-04 04:47 | @chuanliang (Chu Jia Ru Chu) long X post | "Which apps might be secretly sending data out? Use the open-source tool NOIR…" | Second wave |
| 11-04 10:40 | @Suu766 | "Holy crap!!! Android users who get over the wall really need to watch their phone privacy" | Circumvention / VPN circles |
| 11-05 | T00ls security forum | cn.t00ls.com/articles-75676.html | Security circles |
| 11-02~05 | Auto-repost accounts | Instagram reels, Facebook "githunt" (calling it the "open-source alternative to Exodus Privacy"), YouTube Shorts, gitdiagram videos, trendshift, hotrepo | English long tail |
| Other | Included in AtomGit G-Star plus a mirror; community-packaged on AUR as noir-audit-bin | README badge; aur.archlinux.org | Domestic open-source platforms vouch for it |

No HN, Reddit, or V2EX threads found (searched, none seen). GitHub trending skips repos created less than 60 days ago, so trending isn't a source here.

### 3. Why now: it caught the "clean up domestic Android phones with adb" wave

Our GitHub data shows that in mid-to-late October, open-source repos for "clean up Android devices with adb, no root" bunched up and blew up:

- Gathin23/cleanyourtv (created 10-17, 52,550 stars, peak +7,120 in one day): cleans Android/Google TV via adb

- pengchujin/aerial-tv (10-20,9,951 stars): a clean desktop for domestic TVs

- **rddmwmddr/android-ad-cleaner (10-24,6,537 stars, 10-28, +2,002 in one day)** : "Turn off ads in domestic Android phone systems… no root, reversible"

- A whole string of free-my-tv, dumbtv, tv-detox, tv-fresh, tellyscope, and others

This wave taught a lot of ordinary users to plug in a cable, enable USB debugging, run a script, and reverse it, and it got the Chinese-speaking crowd into the habit of reposting these repos. NOIR launched a week later with a different angle: **it went from "remove ads" to "who is stealing my data"** . That's more emotional (domestic phones, getting around the firewall, contacts leaked out), and it spoke directly to the people who had just learned to use adb.

### 4. Competitors

| Name | Where | Launched | Scale | How NOIR is different |
|---|---|---|---|---|
| Exodus Privacy (app + website) | Open source / Android / web | 2017–2018 | exodus 814 stars, Android app 1,053 stars; the website sometimes goes down (privacyguides forum) | Exodus matches against the signatures of known tracker SDKs, and its results are for the version on the Play Store. NOIR scans the APKs actually installed on your phone (including system preinstalled apps), extracts every URL, groups them by vendor (Xiaomi / Tencent / AMap), pairs them with permissions, and gives you remediation and rollback. |
| TrackerControl | Open-source Android app | 2019 | 2,723 star | It intercepts traffic in real time on the phone with a local VPN. NOIR is a static audit run from a computer and doesn't stay resident. |
| universal-android-debloater(-next-generation) | Open-source cross-platform GUI | 2021 / 2023 | 20,341 / 9,758 star | Both use adb and need no root. UAD's focus is uninstalling preinstalled apps from a list. NOIR's focus is the audit report (permissions → data → domains), with remediation as a side feature. |
| rddmwmddr/android-ad-cleaner | Open source | 2026-10-24 | 6,537 star | It turns off ads and push notifications. NOIR is about privacy leakage, the next need for the same users. |
| App Manager(MuntashirAkon) | Open-source Android app | 2020 | 9,459 star | It lets you view trackers, appops, and components on the phone and has more features, but there's no "one click for a report + rollback file" flow, and it doesn't run on a computer. |
| MobSF / MVT | Open source | 2015 / 2021 | 22,146 / 15,747 star | Professional mobile security scanning and forensics with a high barrier to entry. NOIR packages these capabilities into a version an ordinary person can pick up. |
| jadx | Open source | 2013 | 51,612 star | NOIR's deep command calls jadx directly. |
| thecybersandeep/adbauditor, OutrageousStorm/android-privacy-hardener | Open source | 2026 | 85 stars / not yet indexed | The ideas are similar (browser-side auditing / adb hardening), but nobody promoted them, so they never took off. |
| The built-in privacy dashboards / permission managers (Android, HyperOS) | Big-company features | — | Available to all users | They only show what an app *can* read, not where the data *goes*. That's exactly the point NOIR's posts sell. |

### 5. Differentiation, and whether that's why it took off

- On features, the difference is **it connects permissions, endpoints in the APK, and data flows into one line** ("what kind of data may flow where"). It also does vendor recognition (localized package names and domains for domestic phones). Remediation commands are reversible and read-only by default. Endpoints are extracted on the phone with unzip + strings, and only a few KB is sent back to the computer.

- On experience, it's built so that an ordinary person can **double-click and run it** . The portable bundle ships with a JRE, the wizard downloads adb automatically, and if no device is connected it walks you through enabling USB debugging step by step for Xiaomi/HyperOS. Errors show what to do instead of a stack trace, the interface is bilingual (Chinese/English), the terminal dashboard looks good, and the screenshots are easy to share.

- Is that the reason? **Partly** . What actually drove traffic was the emotion of "domestic phones are stealing data" and that real-device screenshot. The feature differences just make the claim hold up. The reposts kept quoting "plug in one cable and see who's sending your location and contacts out" and "every fix comes with a rollback command." Nobody was comparing its detection accuracy with Exodus's. What really made the difference was **the format of producing a report people can understand** .

### 6. How many people are seeing it now

It's spreading in small circles and has started to expand outward: a few X accounts with hundreds of thousands of views in the Chinese-language scene, T00ls, Telegram channels, reposts in Japanese, Russian, and Portuguese, and a pile of auto-repost accounts. No mainstream media coverage, and no HN or Reddit. The open-source project has no revenue.

### 7. Copycats and followers

- anthonyonazure/NOIR: "English translation of Verlintas/NOIR", an English-translated version

- A gitcode mirror at zzj-sys/Verlintas.NOIR; also knightcn1983/NOIR-android and 255 other forks

- Nichr (an ideas site) has already written up the direction "turn the Android debloat CLI into a consumer privacy app" (nichr.tech, 11-04)

- A similar project from the same period, cavaleiro-ai/android-optimizer (11-01, a Claude Code skill that optimizes phones via adb), has 38 stars and never took off.

- Issue #14 "Featured in OpSecRadar Mobile Privacy Playbook", which looks like someone else using it to drive traffic.

### 8. What others can learn

1. **Riding a behavior people have already been trained into** : the adb cleanup wave had already taught hundreds of thousands of people to "plug in + enable USB debugging." Switching to a stronger pain point on the same action (from removing ads to stopping data theft) costs almost nothing to acquire users.

2. **Using real-device screenshots and an us-vs-them mood as the hook** : "I scanned my Xiaomi 17 Pro Max, and guess what," then bigger accounts picked it up with "didn't I tell you not to use domestic phones." The tech accounts and the circumvention crowd on Chinese X eat this up.

3. **A tool ordinary people can use** : portable bundle, wizard, and rollback on every fix. That lowers the risk for people reposting it ("it won't brick your phone").

4. **Release cadence** : tweeted within 12 minutes of the repo being created, 6 releases in 14 days, and downloads kept coming in.

5. It could be copied elsewhere: "data leak audits" for iOS (configuration profiles / privacy reports), TVs, car head units, and Windows preinstalled software. Or the report could become a phone app or web version (Nichr already suggested this direction).

### 9. Still unclear

- The stargazer timeline and account quality weren't pulled (API 404 + rate limits), so a small amount of star-padding can't be fully ruled out. But the fork ratio and download numbers look like real usage.

- The author's X follower count and @geekbb's follower count weren't verified. Whether there was payment or cross-promotion between the author and the repost accounts is unknown.

- What "big fat fish" specifically refers to (some AI assistant?) is unverified.

- Static analysis can only show "possible leakage," and the false-positive rate is unclear. User retention and reuse (is one scan enough?) are unclear, and growth may fade as the topic cools.

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.