Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
adbkit-apkreader
Advanced tools
adbkit-apkreader provides a Node.js API for extracting information from Android APK files. For example, it allows you to read the AndroidManifest.xml
of an existing APK file.
Install via NPM:
npm install --save adbkit-apkreader
AndroidManifest.xml
of an APKconst util = require('util')
const ApkReader = require('adbkit-apkreader')
ApkReader.open('HelloApp.apk')
.then(reader => reader.readManifest())
.then(manifest => console.log(util.inspect(manifest, { depth: null })))
A convenience constant with the value 'AndroidManifest.xml'
. Can use useful with other API methods in certain circumstances.
Alternate syntax to manually creating an ApkReader instance. Currently, only files are supported, but support for streams might be added at some point.
Note that currently this method cannot reject as the file is opened lazily, but this may change in the future and therefore returns a Promise for fewer future compatibility issues. On a related node, calling the constructor directly is still possible, but discouraged.
Promise
that resolves with an ApkReader
instance.Reads the content of the given file inside the APK.
'META-INF/MANIFEST.MF'
as the path would read the content of that file.Promise
that resolves with a Buffer
containing the full contents of the file.Reads and parses the AndroidManifest.xml
file inside the APK and returns a simplified object representation of it.
Promise
that resolves with a JavaScript Object
representation of the manifest. See example output below. Rejects on error (e.g. if parsing was unsuccessful).{ versionCode: 1,
versionName: '1.0',
package: 'com.example.hello.helloapp.app',
usesPermissions: [],
permissions: [],
permissionTrees: [],
permissionGroups: [],
instrumentation: null,
usesSdk: { minSdkVersion: 7, targetSdkVersion: 19 },
usesConfiguration: null,
usesFeatures: [],
supportsScreens: null,
compatibleScreens: [],
supportsGlTextures: [],
application:
{ theme: 'resourceId:0x7f0b0000',
label: 'resourceId:0x7f0a000e',
icon: 'resourceId:0x7f020057',
debuggable: true,
allowBackup: true,
activities:
[ { label: 'resourceId:0x7f0a000e',
name: 'com.example.hello.helloapp.app.MainActivity',
intentFilters:
[ { actions: [ { name: 'android.intent.action.MAIN' } ],
categories: [ { name: 'android.intent.category.LAUNCHER' } ],
data: [] } ],
metaData: [] } ],
activityAliases: [],
launcherActivities:
[ { label: 'resourceId:0x7f0a000e',
name: 'com.example.hello.helloapp.app.MainActivity',
intentFilters:
[ { actions: [ { name: 'android.intent.action.MAIN' } ],
categories: [ { name: 'android.intent.category.LAUNCHER' } ],
data: [] } ],
metaData: [] } ],
services: [],
receivers: [],
providers: [],
usesLibraries: [] } }
Reads and parses the binary XML file at the given path inside the APK file. Attempts to be somewhat compatible with the DOM API.
'AndroidManifest.xml'
as the path would parse the manifest (but you'll probably want to use reader.readManifest()
instead).Promise
that resolves with a JavaScript Object
representation of the root node of the XML file. All nodes including the root node have the properties listed below. Rejects on error (e.g. if parsing was unsuccessful).
null
if none.1
for element nodes, 2
for attribute nodes, and 4
for CData sections.null
, String
, Boolean
, Number
or even an Object
for the most complex types.String
representation of the type of the value.Opens a readable Stream to the given file inside the APK and runs the given action with it. The APK file is kept open while the action runs, allowing you to process the stream. Once the action finishes, the APK will be automatically closed.
'META-INF/MANIFEST.MF'
as the path would open that file.Promise
that resolves when you're done processing the stream. The value that the Promise
resolves with will also be the value that usingFileStream()
resolves with.
Promise
that resolves with whatever action
resolves with.See CONTRIBUTING.md.
See LICENSE.
Copyright © The OpenSTF Project. All Rights Reserved.
3.2.0 (2020-02-06)
FAQs
Extracts information from APK files.
The npm package adbkit-apkreader receives a total of 32,068 weekly downloads. As such, adbkit-apkreader popularity was classified as popular.
We found that adbkit-apkreader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.