Node APK

A modern library to parse Android application's manifest and signature.

Requirements

• Node.js 20 or later
• ESM module system (no CommonJS support)

Installation

npm install node-apk

TypeScript is highly recommended — this library has full type support.

Usage

Import the Apk class and instantiate it with your APK's file path or Buffer:

import { Apk } from "node-apk";

const apk = new Apk("yourapplication.apk");
// Or with a Buffer:
// const apk = new Apk(buffer);

Manifest information

const manifest = await apk.getManifestInfo();

console.log(`package = ${manifest.package}`);
console.log(`versionCode = ${manifest.versionCode}`);
console.log(`versionName = ${manifest.versionName}`);

// For properties without existing accessors, use the raw binary XML
console.log(JSON.stringify(manifest.raw, null, 4));

Certificate information

const certs = await apk.getCertificateInfo();

for (const cert of certs) {
  console.log(`issuer = ${cert.issuer.get("CN")}`);
  console.log(`subject = ${cert.subject.get("CN")}`);
  console.log(`validUntil = ${cert.validUntil}`);
  console.log(cert.bytes.toString("base64"));
  
  // Access the certificate chain
  for (const chainCert of cert.chain) {
    console.log(`  chain: ${chainCert.subject.get("CN")}`);
  }
}

App label (helper)

// Get the app label, optionally preferring a specific locale
const label = await apk.getLabel();
const frenchLabel = await apk.getLabel({ locale: "fr" });
console.log(`label = ${label}`);

Launcher icon (helper)

// Get the launcher icon as a Buffer (PNG or WebP format)
const icon = await apk.getLauncherIcon();

// Prefer a specific density
const hdpiIcon = await apk.getLauncherIcon({ density: "hdpi" });

// Save to file
import { writeFile } from "node:fs/promises";
await writeFile("icon.png", icon);

Application resources (low-level)

For advanced use cases, access resources directly:

const [manifest, resources] = await Promise.all([
  apk.getManifestInfo(),
  apk.getResources(),
]);

// Resolve a resource ID to all its localized values
const labelId = manifest.applicationLabel;
if (typeof labelId === "number") {
  const all = resources.resolve(labelId);
  const frenchResource = all.find((res) => res.locale?.language === "fr");
  const label = (frenchResource ?? all[0])?.value;
  console.log(`label = ${label}`);
}

// Resolve and extract a specific resource
const iconId = manifest.applicationIcon;
const iconResource = resources.resolve(iconId)[0];
if (iconResource) {
  const iconBytes = await apk.extract(`res/${iconResource.value}.png`);
}

Extract arbitrary files

const fileContent = await apk.extract("assets/data.json");

API

Apk

The main class for parsing APK files.

Constructor

• new Apk(input: string | Buffer) — Create an Apk instance from a file path or Buffer.

Methods

• getManifestInfo(): Promise<Manifest> — Parse and return the AndroidManifest.xml.
• getCertificateInfo(): Promise<Certificate[]> — Extract and return signing certificates.
• getResources(): Promise<Resources> — Parse and return the resources.arsc.
• extract(key: string): Promise<Buffer> — Extract a file from the APK by path.
• getLabel(options?): Promise<string> — Get the resolved app label from resources. Options: { locale?: string } to prefer a specific locale.
• getLauncherIcon(options?): Promise<Buffer> — Get the launcher icon as a Buffer (PNG or WebP). Options: { density?: "mdpi" | "hdpi" | "xhdpi" | "xxhdpi" | "xxxhdpi" } to prefer a specific density.

Manifest

Represents the parsed AndroidManifest.xml.

Properties

• package: string — The package name.
• versionCode: number — The version code.
• versionName: string — The version name.
• applicationLabel: string | number — The application label (string or resource ID).
• applicationIcon: number — The application icon resource ID.
• permissions: Iterable<string> — Required permissions.
• receivers: Iterable<Receiver> — Broadcast receivers.
• raw: XmlElement — The raw XML element tree.

Certificate

Represents a signing certificate.

Properties

• serial: string — The certificate serial number.
• validFrom: Date — Validity start date.
• validUntil: Date — Validity end date.
• issuer: Map<string, string> — Issuer attributes.
• subject: Map<string, string> — Subject attributes.
• bytes: Buffer — The raw certificate bytes (DER encoded).
• parent?: Certificate — The parent certificate in the chain.
• chain: Certificate[] — The full certificate chain.

Resources

Resource table parser.

Methods

• resolve(id: number): Resource[] — Resolve a resource ID to its values.

Resource

A resolved resource value.

Properties

• value: ResourceValue — The resource value (string, number, boolean, or null).
• locale?: Locale — The locale if the resource is localized.

Migration from v1.x

Version 2.0 is a complete rewrite with breaking changes:

ESM Only

This package now requires ESM. CommonJS is not supported.

// package.json must have:
{
  "type": "module"
}

Named Exports Only

Default export has been removed. Use named exports:

// v1.x
import Apk from "node-apk";

// v2.x
import { Apk } from "node-apk";

Async/Await

All methods now return Promises. Use async/await:

// v1.x
apk.getManifestInfo().then((manifest) => { ... });

// v2.x
const manifest = await apk.getManifestInfo();

Removed close() Method

The close() method has been removed as it was a no-op.

// v1.x
apk.close();

// v2.x - no cleanup needed

License

This software is licensed under the MIT license.

Copyright © 2019-2024 All rights reserved. sRaH