
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This command line interface enables you to build very fast and lightweight Android Applications from your JS/TS Frontend.
npm install -g apkjs
After installing it, run apkjs --help to see list of options:
apkjs: Build frontend into Android APK
usage: apkjs -h|--help|help
usage: apkjs -v|--version|version
usage: apkjs init [appdata?]
appdata Path to create APK building info file
[Default: 'appdata.json']
- Create APK building info file with default values
usage: apkjs cc|clear-cache
- Clear cache from previous compilation
usage: apkjs clear-logs
- Clear error.log and info.log. (.../node_modules/apkjs/)
usage: apkjs b|build [appdata?]
appdata Build APK with building info located in appdata
[Default: 'appdata.json']
- Build APK from building info file
+ Requires: JAVA
usage: apkjs s|sign
- Instructions to generate custom Keystore file
usage: apkjs s|sign [apk] [keystore?] [password?]
apk Already built APK to be signed
keystore Keystore file. [Default: debug.keystore (.../node_modules/apkjs/)]
password Keystore Password. [Default: 123456 (debug.keystore password)]
- Sign APK with custom keystore
usage: apkjs s|sign [apk]
- Sign APK with a debug keystore
+ Intended for testing
? First time will ask for SDK location
! Requires: SDK
Type a command followed by 'help' to get specific information.
Ex.: apkjs init help
Examples:
– Create appdata.json in cwd
$ apkjs init
– Build APK (apk cannot be installed without signing)
$ apkjs b appdata.json
– Sign APK for testing/debugging
$ apkjs s my-app.apk
– Sign APK for release
$ apkjs s my-apk release-keystore.jks passwd
– Get specific help for clear-cache
$ apkjs cc help
– Clear cache
$ apkjs cc
apkjs has a prebuilt APK (base.apk) ready to be decompiled, with an empty HTML and a JSInterface (for native purposes).
Build process:
Since the decompilation process is very long, it is being saved (cached) for not decompile again.
If there is some issue with the cached base.apk you can type apkjs clear-cache or apkjs cc to remove this saved instance of invalid base apk.
This file describes how apkjs will build your application.
{
"include": "src",
"output": "release/my-app.apk",
"appinfo": {
"package": "com.example.helloworld",
"appname": "Hello World",
"color": "#FF0000",
"versionCode": 1,
"versionName": "1.0",
"icon": "res/icon.png"
}
}
When building this appdata.json, apkjs will include everything from src/ into base.apk and build it to release/my-app.apk
Important base.apk entry point is index.html, so there must be inside src/ a file named index.html
apkjs come along with a prebuilt interface to perform native Android functions (show a toast, message, notification, etc)
This example shows how to make a toast:
Android.showToast("Hello World", Android.TOAST_SHORT);
See all in @types/apkjs
/android-studio/app/release.jks for signing./gradlew clean
./gradlew :app:assembleRelease
/assets/base.apkcp -fv android-studio/app/build/outputs/apk/release/app-release-unsigned.apk assets/base.apk
npm run build
(use tsc if you dont want to copy the assets to dist/)
![]()
FAQs
Build a frontend into Android APK
We found that apkjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.