
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
A command-line tool to extract APKs from connected Android devices.

npm install -g apk-puller
Basic usage:
apk-puller
With options:
apk-puller --filter "Chrome" --output ~/Downloads
-f, --filter <search>: Filter apps by name or package name-o, --output <directory>: Specify output directory for the APK file (defaults to current directory)If you need to make an app trust your certificate on a non-rooted device (useful for debugging/testing):
Extract the APK:
apk-puller --filter "YourApp"
Decompile the APK:
apktool d YourApp.apk
Edit the network security configuration:
<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system"/>
<certificates src="user"/>
</trust-anchors>
</base-config>
</network-security-config>
Update AndroidManifest.xml to use the config:
<application
android:networkSecurityConfig="@xml/network_security_config"
...
>
Rebuild and sign:
apktool b YourApp -o YourApp_modified.apk
keytool -genkey -v -keystore debug.keystore -alias debugkey -keyalg RSA
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore debug.keystore YourApp_modified.apk debugkey
Install the modified APK:
adb install -r YourApp_modified.apk
Extract an APK to analyze its dependencies and libraries:
apk-puller --filter "AppName" --output ~/analysis
cd ~/analysis
unzip AppName.apk -d extracted
ls -la extracted/lib/
Save a working version before updating:
# Create backup directory
mkdir -p ~/app_backups/AppName
# Pull current version
apk-puller --filter "AppName" --output ~/app_backups/AppName
# Rename with version
mv ~/app_backups/AppName/com.example.app.apk ~/app_backups/AppName/v1.2.3.apk
When working with multiple devices:
# Pull same app from different devices
apk-puller --filter "AppName"
# Tool will show device selection:
? Select a device:
❯ Pixel_4_API_30 (emulator-5554)
RealDevice (RF8R90XXXXX)
When you run apk-puller without any options, you'll see an interactive menu:
If multiple devices are connected, you'll see a device selection menu:
? Select a device:
❯ RF8R90XXXXX
emulator-5554
Then you'll see a list of all user-installed apps:
? Select an app to extract:
❯ Instagram (com.instagram.android)
Chrome (com.android.chrome)
WhatsApp (com.whatsapp)
Gmail (com.google.android.gm)
...
After selection, you'll see the success message:
Successfully pulled APK to: /path/to/directory/com.instagram.android.apk
When using the --filter option, you'll see a filtered list of apps:
$ apk-puller --filter "Chrome"
? Select an app to extract:
❯ Chrome (com.android.chrome)
Chrome Beta (com.android.chrome.beta)
Chrome Dev (com.android.chrome.dev)
You might see these error messages in certain situations:
No devices connected:
Error: No devices found. Please connect an Android device and enable USB debugging.
No matching apps found:
Error: No apps found matching "NonExistentApp"
ADB not installed:
Error: Make sure ADB is installed and available in your PATH
If you encounter any issues:
FAQs
A CLI tool to extract APKs from connected Android devices
The npm package apk-puller receives a total of 2 weekly downloads. As such, apk-puller popularity was classified as not popular.
We found that apk-puller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.