> For the complete documentation index, see [llms.txt](https://docs.talsec.app/appsec-articles/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/appsec-articles/glossary/sideloading/installation-sources-cookbook.md).

# Installation Sources Cookbook

This section provides a categorized reference of Android package names that the operating system may report as an installation source. You can use these reference tables to copy and paste exact package identifiers when configuring your RASP or Malware Detection trusted sources.

{% hint style="info" %}
**Android Configurations Only**

* The following trusted source configurations apply exclusively to Android applications. 
* This topic is not relevant on iOS.
  {% endhint %}

***

## Configuring Trusted Sources

The tables in the Cookbook below tell you which packages to trust. Where you register them depends on the product and tier:

<table><thead><tr><th width="175.97265625">Product</th><th>Free tier</th><th>Premium tier</th></tr></thead><tbody><tr><td><strong>RASP</strong></td><td><code>supportedAlternativeStores</code> in <code>TalsecConfig</code> (<code>supportedStores</code> on Flutter).</td><td>In the <strong>Supported Alternative Stores</strong> section in the <a href="https://my.talsec.app/">Talsec Portal</a>.</td></tr><tr><td><strong>Malware Detection</strong></td><td><code>trustedInstallSources</code> in <code>SuspiciousAppDetectionConfig</code>.</td><td><code>trustedInstallationSources</code> in the JSON payload for Malware Configuration API.</td></tr></tbody></table>

***

## Official & OEM Stores

These represent legitimate distribution channels. Add the stores relevant to your application's distribution strategy and target market to your trusted sources to prevent false positives.

<table><thead><tr><th width="199.76953125">Package Name</th><th width="133.1953125">Store / Channel Name</th><th>Add to RASP?</th><th width="115.76171875">Add to Malware Detection?</th><th>Notes</th></tr></thead><tbody><tr><td><code>com.android.vending</code></td><td>Google Play</td><td>No, it's included </td><td>✅ Yes</td><td>Official Google app store for Android.</td></tr><tr><td><code>com.huawei.appmarket</code></td><td>Huawei AppGallery</td><td>No, it's included</td><td>✅ Yes</td><td>Official store for Huawei devices.</td></tr><tr><td><code>com.sec.android.app.samsungapps</code></td><td>Samsung Galaxy Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Samsung devices.</td></tr><tr><td><code>com.xiaomi.mipicks</code></td><td>Xiaomi GetApps</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Xiaomi / Redmi / POCO.</td></tr><tr><td><code>com.xiaomi.market</code></td><td>Xiaomi Market</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for older/Chinese Xiaomi devices.</td></tr><tr><td><code>com.oppo.market</code></td><td>Oppo App Market</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Oppo devices.</td></tr><tr><td><code>com.heytap.market</code></td><td>HeyTap App Market</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Realme and newer Oppo.</td></tr><tr><td><code>com.vivo.appstore</code></td><td>Vivo App Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Vivo devices.</td></tr><tr><td><code>com.bbk.appstore</code></td><td>BBK / iQOO App Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Vivo / iQOO devices.</td></tr><tr><td><code>com.meizu.mstore</code></td><td>Meizu App Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Meizu devices.</td></tr><tr><td><code>com.lenovo.leos.appstore</code></td><td>Lenovo App Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Official store for Lenovo / Motorola devices.</td></tr><tr><td><code>com.transsnet.store</code></td><td>Transsion App Store</td><td>✅ If targeting</td><td>✅ Yes</td><td>Transsion ecosystem store, common on TECNO, Infinix, and itel devices.</td></tr><tr><td><code>com.amazon.venezia</code></td><td>Amazon Appstore</td><td>✅ If targeting</td><td>✅ Yes</td><td>Alternative store on standard Android.</td></tr><tr><td><code>dev.firebase.appdistribution</code></td><td>Firebase App Distribution</td><td>⚠️ Dev Only</td><td>⚠️ Dev Only</td><td>Trust only during internal testing phases. Strip from production builds.</td></tr></tbody></table>

***

## System Package Installers

These system components execute user-driven sideloads.

{% hint style="danger" %}
**Critical Security Risk**&#x20;

Adding any of the system installers below to your trusted sources effectively permits all manual sideloading (e.g., users tapping on an APK in their file manager). Doing so bypasses core security evaluations and is strongly discouraged in production environments.
{% endhint %}

| Package Name                          | Platform Context                    | Add to RASP? | Add to Malware? |
| ------------------------------------- | ----------------------------------- | ------------ | --------------- |
| `com.google.android.packageinstaller` | Default package installer.          | ❌ No         | ❌ No            |
| `com.android.packageinstaller`        | Legacy alias for default installer. | ❌ No         | ❌ No            |
| `com.sec.android.preloadinstaller`    | Samsung's proprietary installer.    | ❌ No         | ❌ No            |
| `com.miui.packageinstaller`           | MIUI / Xiaomi package installer.    | ❌ No         | ❌ No            |
| `com.android.shell`                   | Shell-initiated install (ADB).      | ❌ No         | ❌ No            |

***

## Common Sideload Installers

When a user manually installs an APK via another application on Android 11 or newer, the Talsec SDK reports that specific app as the installer. Adding these to your trusted sources would permit all apps installed via these specific channels.

<table><thead><tr><th width="220.50390625">Package Name</th><th>App / Service</th><th>Add to RASP?</th><th>Add to Malware?</th></tr></thead><tbody><tr><td><code>com.android.chrome</code></td><td>Google Chrome</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>org.telegram.messenger</code></td><td>Telegram</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.whatsapp</code></td><td>WhatsApp</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.dropbox.android</code></td><td>Dropbox</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.google.android.apps.nbu.files</code></td><td>Files by Google</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.apkpure.aegon</code></td><td>APKPure (Unofficial store)</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>cn.xender</code></td><td>Xender — file sharing / transfer app.</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.aurora.store</code></td><td>Aurora Store — unofficial third-party Google Play client.</td><td>❌ No</td><td>❌ No</td></tr><tr><td><code>com.gbox.android</code></td><td>GBox — app virtualization environment that runs apps in an isolated container.</td><td>❌ No</td><td>❌ No</td></tr></tbody></table>

***

## Cloners & Movers

When apps are transferred to a new device using a cloner or migration tool, Talsec does not recognize the cloner as an official installation source. Apps that arrived this way are therefore evaluated as having an untrusted origin.

{% hint style="warning" %}
**Configuration Strategy for Migration Tools**&#x20;

By default, Talsec SDK treats cloner-installed apps as untrusted for both checks. Migration tools are a known vector for malware delivery — an attacker can inject modified apps into the migration payload, and the cloner becomes their attributed installer.

Adding cloners to your trusted sources is only recommended if your specific threat model explicitly tolerates post-migration apps running without re-verification from an official store. For security-sensitive applications (banking, healthcare, enterprise), keep cloners out of both configurations.
{% endhint %}

<table><thead><tr><th width="211.0390625">Package Name</th><th>App / Service</th><th>Add to RASP?</th><th>Add to Malware?</th></tr></thead><tbody><tr><td><code>com.miui.huanji</code></td><td>Mi Mover (Xiaomi)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.xiaomi.midrop</code></td><td>ShareMe (Xiaomi)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.miui.backup</code></td><td>MIUI Backup (Xiaomi)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.hicloud.android.clone</code></td><td>Phone Clone (Huawei)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.hihonor.android.clone</code></td><td>Phone Clone (Honor)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.sec.android.easyMover</code></td><td>Smart Switch (Samsung)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.coloros.backuprestore</code></td><td>Clone Phone (Oppo)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.vivo.easyshare</code></td><td>EasyShare (Vivo)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.oneplus.backuprestore</code></td><td>Clone Phone (OnePlus)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>com.lenovo.anyshare.gps</code></td><td>SHAREit (Lenovo)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr><tr><td><code>shareit.lite</code></td><td>SHAREit Lite (Lenovo)</td><td>⚠️ Evaluate</td><td>⚠️ Evaluate</td></tr></tbody></table>

***

## Talsec-Defined Markers for ADB and Unknown Sources

When the Android OS cannot provide a valid installer package name, the Talsec SDK normalizes missing values into specific string markers. These are not actual Android package names, but you can include the exact strings below in your trusted installation sources just like standard package identifiers.

{% hint style="warning" %}
**Development Use Only**

**Most integrations do not need this section.** Markers are intended for development, QA, and CI builds. They should never appear in your production trusted sources, as they would silently permit any app installed via ADB or from an undetermined source — including attacker-initiated sideloads.
{% endhint %}

<table><thead><tr><th width="141.8203125">Marker String</th><th>Context</th><th>Add to RASP?</th><th>Add to Malware?</th><th>Notes</th></tr></thead><tbody><tr><td><code>adb</code></td><td>Application installed via Android Debug Bridge (<code>adb install</code>).</td><td>⚠️ Dev Only</td><td>⚠️ Dev Only</td><td>Use only in development and CI builds. Never whitelist in production.</td></tr><tr><td><code>unknown</code></td><td>The OS could not determine the source.</td><td>⚠️ Dev Only</td><td>⚠️ Dev Only</td><td>Use only in development and CI builds. Never whitelist in production.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.talsec.app/appsec-articles/glossary/sideloading/installation-sources-cookbook.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.