78,000 Stars in Two Days: Reflections on the Boundaries of "Software Cloning" with REA
Start with two snapshots. On October 10, when I first dug into REA, it had 62,202 stars. Today: 140,193. That's 78,000 stars in two days — more than doubled.
Behind the numbers is a clear timeline. On October 10, the YouTube channel Eric Tech published *How To Use REA To Clone Any Software In Minutes*, which hit 131,000 views in two days. In the same window, the project's npm package was pushed to version 6.4.0, the GitHub repo picked up a trendshift badge, and the Discord community opened a show-and-tell channel. The video was the fuse, the repo the gunpowder — every link in this viral chain checks out.
What REA Actually Is
First, let's be precise about the project. REA (Reverse Engineer Anything) is not a reverse-engineering engine — it doesn't decompile anything itself. It's a bridge: it wraps established reverse-engineering tools like Hopper, Ghidra, and IDA, and security tools like JADX, pwntools, and mitmproxy, behind a unified interface and connects them via MCP to coding agents such as Claude Code and Codex. When the agent says "look at this function in this binary," the bridge calls the real tool and brings the result back. Seven bridges, covering three categories: native binaries, Android apps, and runtime behavior.
The hardest example in its own showcase: using the 90s game DX-Ball as an experiment, the 3,205 recovered original x86 function test cases, when recompiled, are byte-for-byte identical to the original. Not "looks like" — byte-identical.
The author, morluto, is an individual developer. Repo created in April this year, first npm release in July, 60k stars three months later, now 140k. That pace would be anomalous in any category.
What Was Cloned in the Video
Eric Tech's demo picked an interesting target: Wispr Flow, a voice-dictation app. Hold a hotkey, speak, release to get text — plus note-taking. Many people use it as a keyboard replacement.
The clone in the video ran three things: global hotkey, note recording, and local transcription. The first two are unremarkable; the third deserves a pause.
Because Wispr Flow has never officially claimed local transcription. Its website FAQ answers the privacy question with "we never sell your data," followed by a row of certifications: SOC 2 Type II, ISO 27001, HIPAA compliance. All of these are artifacts of cloud processing — data leaves your device, enters its servers, and is covered by a compliance regime. The clone does the opposite: the transcription model runs entirely on your machine, and voice data never leaves.
This detail draws the true boundary of "cloning" very clearly. What can be cloned is the product form: hotkey interactions, note structure, interface layout — the visible, tangible parts. What cannot be cloned are two things: Wispr Flow's cloud transcription model pipeline (trained on massive amounts of real dictation data), and those three certifications (compliance audits bought with money and time). The clone swaps in a local small model and gains a louder privacy pitch, but transcription accuracy is likely a notch worse — the official model was tuned on millions of users' voices; local whisper-class models are not.
So the accurate statement isn't "cloned Wispr Flow" — it's "cloned Wispr Flow's interaction shape, swapped the engine, and picked up a privacy selling point the official product never offered."
How the Binary Side Fits In
The video also covered the workflow for binary analysis with Hopper. REA's rules: static JavaScript apps (the Electron kind) need no reverse-engineering engine at all — just read; native binaries (compiled C/C++, games, system tools) require you to bring your own Hopper, Ghidra, or IDA, though at setup you can allow the installer to install Hopper on your behalf after approval. The README's hero image shows an REA analysis bridge running inside the Hopper UI. This layer of design is honest: it knows it's the gate, not the hammer — if you want to crack a binary open, you bring your own hammer.
Unpacking "Code Is No Longer a Moat"
The video's core claim: code is no longer a moat; brand and users are. This isn't a new argument — the commoditized-complements theory dates back to open source's golden age. But back then cloning an app meant hiring people to read code for months; now it's one agent plus one evening. The slogan has gone from theory to a keystroke, and that changes its weight.
Why does brand hold? Because brand is essentially a cache of pre-verification. Users don't reverse-engineer software before buying to check for backdoors, memory leaks, or privacy holes — nobody could afford that inspection. A brand's meaning is packaging everyone else's checks into a receipt: this many people used it, this many outlets reviewed it, SOC 2 audited it, so you can just trust it. A clone can copy features; it cannot copy the receipt. Ironically, Wispr Flow's three certifications are exactly the "receipts" the company paid for up front — moat maintenance costs, with the price clearly marked.
Why do users hold? Because users are data. Wispr Flow's transcription model is polished by millions of real dictations daily: how people speak, where they pause, how jargon is spelled. That data only grows inside a real product. However complete a clone's feature list, without this data stream, the model gap only widens.
Put the three layers together and the boundary is neat: code can be taken overnight; data and trust are accumulated slowly. REA has stomped the first layer's barrier into the ground — effectively a stress test for every software company. The result: the first layer indeed protects nothing, and that's all.
npm's 6.4.0 shipped yesterday, and the repo is still being flooded with stars today. Where that number finally settles probably depends on the next video.