Chromalink.

About the install warning

Your browser or phone may warn you because you’re downloading an APK or installing from outside an app store. Those checks matter: an app can run code on your device, and decades of dodgy downloads have given browsers and phones good reason to be cautious. But a warning about an unfamiliar file or unknown source isn’t, by itself, a finding that the app contains malware. It can be a prompt to pause because the system can’t vouch for it.

If Play Protect offers a scan, let it run; it checks apps from outside the Play Store too. If it reports no threats, that’s useful evidence that it hasn’t identified a problem with that build, though it isn’t a guarantee. A scan request is different from a warning that identifies an app as harmful, so leave Play Protect on and take a warning of harmful software seriously.

What’s in the review files

I’ve added the downloads below to make the build easier to inspect before you install anything. They include readable app source, permission and manifest details, compiled bytecode and hashes for checking that the APK matches this release. Attach the text file to an LLM chat; the ZIP adds the full bytecode for agents with file tools.

The source and report are supplied by me, so they aren’t an independent audit. A matching hash confirms which file you have; it doesn’t tell you whether that file is safe.

Even pulling an APK apart with JADX, Apktool or Ghidra and checking its manifest can’t prove it will always be safe. Some behaviour only appears while it runs, under particular conditions or through a server it contacts, and hidden behaviour can be missed. Scans and code reviews help you judge the risk, but they can’t remove it entirely.

I’m putting this out under the ValentineDesigns name I use for the rest of my work, and the goodwill and friendships around that matter far more to me than getting someone to install a puzzle game. You can weigh that context alongside the actual checks, without having to reverse-engineer every download yourself. If you’d prefer to wait for an app-store release, that’s fine too.

Can you check this Chromalink Android build for suspicious behaviour? I’ve attached its review files. Look at the permissions, network connections, file access and any components other apps can reach. If I’ve also attached the APK and you can inspect it, check it against the supplied hashes and compiled details. The source and report come from the developer, so don’t assume they prove the APK is safe. Show me where any concerns appear in the code, and be clear about what you couldn’t verify. Explain what you find in plain English.

APK SHA-256 4cb2a375709629c492bca36222aa55bcb9b7db9578728816413af69a476f18c9

Read more: Chrome download warnings · Google Play Protect · OWASP’s testing guide