dev.to guide offers a five-minute checklist for vetting sideloaded Android APKs

A guide published on dev.to on November 2 lays out a roughly five-minute routine for vetting Android packages before installing them from outside Google Play. The author's framing is direct: sideloading is what makes Android flexible — older app versions, early updates, software absent from Play — but it is also, according to the guide, the route most Android malware takes to reach users, typically as repackaged copies of genuine apps hosted on sites designed to look legitimate.

Judge the source before the file

According to the guide, the majority of the risk is settled before a download begins. It arranges common sources on a trust scale: Google Play sits at the top because apps there are developer-signed, scanned by Play Protect and updated automatically. A developer's own site or GitHub releases rank just below, followed by F-Droid, which generally builds from published source code. Established mirrors such as APKMirror occupy a middle tier — free apps only, with signatures checked against earlier releases. Generic "APK download" sites sit near the bottom, and the guide's advice on "mod", "Pro unlocked" or "cracked" files is unambiguous: avoid them, because they are modified and re-signed by unknown parties by design. The author's rule of thumb is that an app which is free on Google Play rarely needs to be fetched anywhere else.

The signing certificate is the strongest check

Android will not install an update unless it carries the same signature as the version already on the device, which makes the certificate the most informative signal available. On the phone, the open-source App Manager can display an APK's signing certificate before installation. On a computer with the Android SDK build tools installed, apksigner verify --print-certs app.apk prints the same information. The guide recommends comparing the SHA-256 certificate digest against a version you already trust — the copy on your device, or a download from the developer's own site — and discarding the file if the digests differ, since a mismatch is the fingerprint of a repackaged app.

Permissions should match what the app does

The guide applies a plain common-sense test to permission requests. A photo editor legitimately needs access to photos, but has no use for SMS, call logs or contacts. A video player has no plausible reason to request accessibility services or device administrator rights. Any request to draw over other apps, from software with no overlay function, is treated as a warning sign. Accessibility access and device admin are singled out as the two permissions most sought after by banking trojans, and the author's advice is to withhold them unless the purpose is fully understood.

Scanning helps, but a clean result proves little

Uploading the file — or only its SHA-256 hash — to VirusTotal is part of the routine, with a caveat: a clean verdict is not evidence of safety, because freshly released malware often goes undetected at first. Conversely, several detections from well-known engines are reason enough to delete the file. The guide also stresses keeping Play Protect enabled, noting that it scans sideloaded apps too, and warns against turning it off simply because a download site tells you to.

Red flags worth memorising

The guide lists tells that recur across shady download sites: downloads gated behind "human verification", surveys or offers; a file name that disagrees with the internal package name; an APK far smaller or larger than the official build; "premium unlocked" claims for apps whose paid features run on the developer's servers, which such mods often cannot deliver anyway; and archives containing an .exe, or instructions to install a "profile".

Split bundles need different tooling

Many current apps no longer ship as a single APK. XAPK, APKM and APKS files are ZIP containers holding a base APK, split APKs and sometimes OBB game data. Android's built-in installer cannot open them — the guide identifies this as the cause of the familiar "There was a problem parsing the package" error — so a split-APK installer, or bundletool install-apks for .apks bundles, is required. Every APK inside the archive deserves the same checks as a standalone file.

Post-install housekeeping

After installation, the guide recommends switching the "Install unknown apps" permission back off for the browser or file manager used, pruning any permissions the app does not need, and watching for full-screen ads, battery drain or unfamiliar icons in the days that follow.

Why it matters

The value of the checklist is that it converts vague advice about sideloading into concrete, verifiable steps that developers can pass on to non-technical users. The signature comparison in particular offers a deterministic answer to whether a file is the developer's own build or a tampered copy — something neither permission lists nor antivirus engines can guarantee. The routine also targets the delivery channel the guide identifies as dominant for Android malware, while preserving the flexibility that makes sideloading worth keeping in the first place. One caveat applies: this is a single author's routine published on dev.to rather than an official vendor guideline, and tools like VirusTotal and Play Protect are presented there as helpful filters, not guarantees.