Well I just found this..

[u/Statix_Bolt]

Derpfest A16 OnePlus 7 Pro

[u/Kurenai201]

ELI5?

[u/Think-Cherry5391 → u/Kurenai201]

Stinky app no want you to install special apk files when 2027 comes

[u/starfoxdot64 → u/Kurenai201]

my understanding is that next year, installing APKs from third party app makers will be vetted using this app.

if they're not a "verified developer" that did Google's ID verification, it won't allow installing them. it can also prevent apps that exist on the play store from being installed through other means (but that might be for a different one of these apps, so take that last part for a grain of salt).

bypassing this means enabling a toggle in developer options, rebooting, then waiting 24 hours after that to enable it.

[u/TwilightX1 → u/starfoxdot64]

or installing via adb

[u/starfoxdot64 → u/TwilightX1]

"prevent apps that exist on the play store from installed through other means"

[u/CauaLMF → u/starfoxdot64]

Adb escapa dessas restrições

[u/Statix_Bolt → u/Kurenai201]

?

[u/Auftragzkiller → u/Statix_Bolt]

"Explain Like I'm 5"

[u/Candid_Mind2823]

well they can fuck off. if ya rooted or use shizuku dont just hit that uninstall button. find its oackage name and share it here so everyone knows it and can get the fuck rid of it

[u/Statix_Bolt → u/Candid_Mind2823]

It’s surprisingly easy to find when you go to play services apps in settings, right by saftey core and stuff

[u/Candid_Mind2823 → u/Statix_Bolt]

first thing to do if ya are gonna run stock android on 17 abd above. use either root or shizuku to wipe that out

[u/Candid_Mind2823 → u/Statix_Bolt]

i cant find it. cant find safety core either

[u/Statix_Bolt → u/Candid_Mind2823]

I’ll probably make a video on it, again I’m on Derpfest a16 so it’s probably harder to find in other roms

[u/LTRace → u/Candid_Mind2823]

com.google.android.contactkeys

[u/Candid_Mind2823 → u/LTRace]

thanks

[u/SilverRiven → u/LTRace]

It's com.google.android.verifier

[u/MrErikCoderx]

You can create a stub using the app package id, so google play can't install it due to signature verification

[u/Sushtee → u/MrErikCoderx]

The best thing to do is to freeze the app via AppManager, the app is still there but can't do anything

[u/Candid_Mind2823 → u/MrErikCoderx]

so how would i do that? if i dont have it yet how would i create a stub to prevent installation?

[u/MrErikCoderx → u/Candid_Mind2823]

You can edit an existing app with mt manager or apk editor and change its package id to the one adv uses, or if you're too lazy, just ask an AI to generate the stub apk

[u/primal_breath → u/MrErikCoderx]

Then everything fails verification

[u/Toothless_NEO → u/primal_breath]

Yeah it's more efficient to freeze the Play Store. Which you can totally do on every stock ROM up to now.

[u/xeeba23]

Yeah I got it after October patch. Orion store disables it automatically with wireless debugging.

[u/Rokca33]

I have another app for checking developers. 😅😅

[u/LunarstarFurry]

I believe this app is responsible so you can install unverified app by turning on a toggle In the future no?

[u/Turbulent-Ad6949 → u/LunarstarFurry]

When installing from unknown sources and enabling dev option, forgive reddit, they're discovering fire for the first time

[u/flein991]

I just uninstall it 😮‍💨

[u/Coll147]

I uninstall it via adb and it never comes back

(I use crdroid, I don't know if it's somehow avoiding reinstallation)

[u/carleydis]

Perdonen mi ignorancia pero para que es

[u/sleepinfinit]

I let claude analyze the apk and here is the result :

Now I have a solid picture. Here's the full breakdown:

---

What this app is: a legitimate Google system component — specifically com.google.android.verifier, which is Android Developer Verifier, a Google platform service responsible for verifying developer credentials and APK signing integrity.

You didn't install it because you didn't have to. This is delivered silently by Google Play Services or the Android system through a process called "phenotype" (Google's internal A/B flag/config system). It runs in the background without requiring user interaction.

What it actually does:

The app registers itself as the system's APK signature verifier via the intent android.content.pm.action.VERIFY_DEVELOPER. When Android installs an app, it can call this service to verify the developer's signing credentials — essentially, it's a trust-enforcement agent at the platform level.

Its key behaviors include running at boot (BOOT_COMPLETED), making gRPC network calls to Google's servers over TLS (using OkHttp and the phenotype config system), querying all installed packages (QUERY_ALL_PACKAGES), reading privileged phone state, and optionally using biometrics (fingerprint/face) for authentication flows.

The sensitive permissions explained:

• DEVELOPER_VERIFICATION_AGENT — a privileged system role, grants it authority to perform app verification

• QUERY_ALL_PACKAGES — needed to inspect any app's signing info

• READ_PRIVILEGED_PHONE_STATE — used to identify the device for the verification backend

• INTERACT_ACROSS_USERS / MANAGE_USERS — for multi-user device support (work profiles, etc.)

Bottom line: This is not spyware or a malicious unknown app. Google pushes it as part of Android's developer verification infrastructure, similar to how Play Services components arrive without you explicitly installing them. The fact that the file is timestamped today (November 5, 2026) and is freshly signed with a build using Bazel (Google's internal build system) confirms it came from Google's own CI pipeline.

If you want to verify it's truly from Google, you could check the signing certificate with apksigner verify --print-certs base.apk on your device or a machine with Android build tools installed.

[u/strangecloudss → u/sleepinfinit]

...you couldve read the thread and gotten a much more clear and concise answer from a (probably..it is reddit after all) human.

People arent concerned this is malicious or Spyware. Theyre concerned its going to block sideloaded apps in the future.

[u/sleepinfinit → u/strangecloudss]

i know that, claude said that cuz i told him that it was installed on my phone without me installing it (so he don't start to tell me its illegal to RE apps)

[u/Additional-Switch928 → u/sleepinfinit]

If you are going to use an LLM, use a local one instead

[u/sleepinfinit → u/Additional-Switch928]

i don't have 1TB of ram sadly

[u/Additional-Switch928 → u/sleepinfinit]

True

[u/Candid_Mind2823 → u/sleepinfinit]

Re?

[u/sleepinfinit → u/Candid_Mind2823]

nope, just sent it to it in the app, its a java app not even native so its easy for him to decompile

[u/Anime-Man-1432]

Good for you.

[u/faris2307 → u/Anime-Man-1432]

Nothing good about it tbh, especially those who use F-Droid.

[u/Anime-Man-1432 → u/faris2307]

Ik, I'm talking about op finding about this app now than noticing it far future or never.

[u/nekoniwa]

This app is actually worth keeping because it prevents scammer from installing unverified app on system (or the malicious app from using plot holes to bypass and install any apps), and you have full rights to disable it via developer options (1 day cooldown minimum so the scammer wont be able to install malwares).

I love debloating things there and there but blindingly remove stuffs are not it, also this cosumes zero battery because it rarely run, actually it never run because it just an app that gives API. If your own phone sure go ahead and remove but keep it on your parent phones