
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
node-apk-parser
Advanced tools
#node-apk-parser based on adbkit-apkreader, add meta data parse feature
node-apk-parser provides a Node.js API for extracting information from Android APK files. For example, it allows you to read the AndroidManifest.xml of an existing APK file.
Install via NPM:
npm install --save node-apk-parser
AndroidManifest.xml of an APKvar util = require('util')
var ApkReader = require('node-apk-parser')
var reader = ApkReader.readFile('HelloApp.apk')
var manifest = reader.readManifestSync()
console.log(util.inspect(manifest, { depth: null }))
Alternate syntax to manually creating an ApkReader instance. Currently, only files are supported, but support for streams might be added at some point.
Error on error (e.g. if the file is not valid)ApkReader instance.Manually construct an ApkReader instance. Useful for testing and/or playing around. Normally you would use ApkReader.readFile(file) to create the instance.
Error on error (e.g. if the file is not valid)Synchronously reads and parses the AndroidManifest.xml file inside the APK and returns a simplified object representation of it.
Error (e.g. if parsing was unsuccessful)Object representation of the manifest. See example output below:{ versionCode: 1,
versionName: '1.0',
package: 'com.cvte.sdk.update',
usesPermissions: [],
permissions: [],
permissionTrees: [],
permissionGroups: [],
instrumentation: null,
usesSdk: { minSdkVersion: 14, targetSdkVersion: 20 },
usesConfiguration: null,
usesFeatures: [],
supportsScreens: null,
compatibleScreens: [],
supportsGlTextures: [],
application:
{ theme: 'resourceId:0x7f060000',
label: 'resourceId:0x7f050001',
icon: 'resourceId:0x7f020000',
debuggable: true,
allowBackup: true,
activities:
[ { label: 'resourceId:0x7f050001',
name: 'com.cvte.sdk.update.MyActivity',
intentFilters:
[ { actions: [ { name: 'android.intent.action.MAIN' } ],
categories: [ { name: 'android.intent.category.LAUNCHER' } ],
data: [] } ],
metaData: [] },
{ theme: 'resourceId:0x1030071',
name: 'com.cvte.sdk.update.UpdateDialogActivity',
intentFilters: [],
metaData: [] } ],
activityAliases: [],
launcherActivities:
[ { label: 'resourceId:0x7f050001',
name: 'com.cvte.sdk.update.MyActivity',
intentFilters:
[ { actions: [ { name: 'android.intent.action.MAIN' } ],
categories: [ { name: 'android.intent.category.LAUNCHER' } ],
data: [] } ],
metaData: [] } ],
services: [],
receivers: [],
providers: [],
usesLibraries: [],
metaDatas:
[ { name: 'MENGYOU_APPKEY',
value: 'a41a4a18b9a1808e4b88f8beea2ddfd1870866c3' } ] } }
Synchronously reads and parses the binary XML file at the given path inside the APK file. Attempts to be somewhat compatible with the DOM API.
AndroidManifest.xml as the path would parse the manifest (but you'll probably want to use reader.readManifestSync() instead).Error (e.g. if parsing was unsuccessful)Object representation of the root node of the XML file. All nodes including the root node have the following properties:
null if none.1 for element nodes, 2 for attribute nodes, and 4 for CData sections.null, String, Boolean, Number or even an Object for the most complex types.String representation of the type of the value.FAQs
Extracts information from APK files.
The npm package node-apk-parser receives a total of 420 weekly downloads. As such, node-apk-parser popularity was classified as not popular.
We found that node-apk-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.