Universal Installer: A Sideloading Swiss Army Knife for Android, With Shizuku and VirusTotal

What Universal Installer Solves and Who It Is For

The stock Android installer fails on split APKs, XAPK archives, and OBB bundles. Universal Installer targets that gap. It is for users who download apps from outside the Play Store, especially those who use APK mirror sites that serve split packages, or who sideload games with large OBB data files. The README positions it as handling what the default installer cannot. That includes merging multiple individual split APKs into one installation session, which is a common pain point when you manually extract splits. It also addresses parsing errors like aconfig_flags.pb on Android 14 and newer, which can break installations of older or oddly packaged APKs. The target audience is clearly a power user: someone willing to grant Shizuku or root access, configure installer profiles, and manage a local network server. Casual users who only install an occasional APK would find the feature set overwhelming.

How It Works: The Mechanism Behind the Install Flow

The app uses Ackpine, a Kotlin library for package installation and uninstallation, as its core engine. Ackpine provides plugins for Shizuku and libsu, which is how Universal Installer achieves silent installs and privileged operations. The flow starts with a package preview bottom sheet that shows app name, icon, version, package, size, min and target SDK, supported ABIs, languages, permissions, OBB count, and split count. This preview appears before you commit to an install, giving you a chance to reject a package that targets an incompatible SDK or requests excessive permissions. For OBB files, the app detects them inside XAPK, APKM, or APKS archives and copies them to Android/obb/<package>/ after the APK installs. The OBB copy runs in a foreground worker via WorkManager, so it survives the app being closed and shows progress in the notification shade. The write strategy falls back through three methods: direct I/O on pre-Android 11 devices, Shizuku with shell UID on modern Android, and SAF tree grant as a last resort. This layered approach is sensible, but it also means the app's behavior depends heavily on what privileges you have granted.

Getting It Running: Commands and Configuration

You can get Universal Installer from the Play Store, F-Droid, IzzyOnDroid, or the GitHub releases page. The package ID is app.pwhs.universalinstaller. There is no command-line setup; installation is a standard APK install. After opening, you grant permissions as needed. For silent installs, you must enable Shizuku or have root access. The README does not give exact setup steps for Shizuku, but it references the Shizuku project, which typically requires either ADB over Wi-Fi or a root environment. Once privileged, you can create Installer Profiles that save custom install configurations, including installer package spoofing, privileged flags, and targeted users. You can set the install source to presets like Google Play, Aurora, F-Droid, Amazon, Samsung, Huawei, Xiaomi, or a custom value. This spoofing is a specific configuration key in the profile. For the LAN file server, you set an optional 4 to 8 digit PIN to restrict access. The remote download feature lets you paste a URL, and files land in /sdcard/Download/UniversalInstaller/ with the Content-Disposition name. These are the main configuration touchpoints, but the README does not list a settings file or command-line interface.

A Genuine Limitation: VirusTotal Uploads and Privacy

The VirusTotal integration is a headline feature, but it has a privacy cost. The app automatically performs an SHA-256 hash lookup on every picked file. If VirusTotal does not know the file, the app optionally uploads it for a multi-engine scan. That upload sends the entire APK, which can be up to 650 MB via VirusTotal's large-file endpoint, to a third-party service. For a user installing a proprietary app or a private build, this could leak the binary. The README says the upload is optional, but the wording suggests the app prompts you. You need to decide whether that trade-off is acceptable. Also, the scan result is a count of engines that flagged the file as malicious, suspicious, harmless, or undetected. That is a useful signal, but it is not a guarantee of safety. A zero-detection result does not mean the app is clean; it only means no participating engine flagged it. This is a limitation of any VirusTotal-based approach, and Universal Installer does not claim otherwise.

The Wrong Tool for Simple Installations

If you only install a single APK from a trusted source, Universal Installer is overkill. The stock installer handles that case fine, and the added layers of preview sheets, VirusTotal checks, and download history add friction. The app's strength is in edge cases: split APKs, OBB files, and silent installs. For those, it is a specialist. But for a routine sideload, the extra steps are unnecessary. Also, the app's heavy reliance on Shizuku or root means that without those privileges, the silent install and installer spoofing features are locked. The README lists these as power-user features that unlock when root or Shizuku is enabled. So a non-rooted user on a locked-down device gets a capable file manager and installer, but not the core differentiators. That is a significant caveat. The app also targets Android 14 through 17, so if you are on an older Android version, some features like the direct I/O OBB write path may behave differently.

Alternatives: InstallerX-Revived and the Ackpine Ecosystem

The README explicitly mentions InstallerX-Revived as an inspiration for the UI animations. That project is a direct alternative, also focused on APK installation with split support and Shizuku integration. The key difference is that InstallerX-Revived is a smaller, more focused tool, while Universal Installer adds a full app manager, LAN file server, and VirusTotal scanning. If you only need silent installs and split APK handling, InstallerX-Revived might be lighter. Another alternative is the Ackpine library itself, which you could integrate into your own app. That is a different approach: instead of using a ready-made app, you build the installer into your own project. Universal Installer uses Ackpine under the hood, so the underlying mechanism is the same, but the user experience differs. For users who want a standalone tool, Universal Installer is more complete; for developers, Ackpine offers more control.

Maintenance and License Considerations

The repository is active, with the latest release v1.10.0 pushed on 2026-08-29, and previous releases in July and August 2026. That suggests ongoing maintenance. The project is licensed under GPL-3.0. This means if you fork or distribute a modified version, you must release the source under the same license. For an end user, this has no direct impact; you can install and use the app freely. For a developer or a company that wants to embed or modify the code, the copyleft obligation is a real consideration. The README does not mention any paid tiers or proprietary components, so the entire app appears to be open source. The tech stack is Kotlin with Jetpack Compose, Ackpine, Shizuku, Ktor, and WorkManager. These are all well-known libraries, which reduces the risk of abandonment. The release cadence, with three releases in about two months, is a positive sign, but it is not a guarantee of long-term support. You should check the issue tracker and commit history before relying on it in a production environment.

Editorial conclusion

Adopt Universal Installer if you regularly sideload split APKs, handle OBB files, or want VirusTotal verdicts before installing. It is also a strong fit for Android TV users who need to push packages over the network. Do not adopt it if you only install simple APKs and prefer the stock installer, because the extra features add complexity and require granting Shizuku or root privileges for the most useful functions. Before adopting, verify that the VirusTotal upload behavior matches your privacy expectations, test the Shizuku setup on your specific Android version, and confirm that the OBB write strategies work on your device, especially if it runs Android 11 or newer. The project is actively maintained with recent releases, but the GPL-3.0 license means any derivative work must also be open source, which could affect commercial distribution.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes