China’s App-Packing Industry and U.S. App Security
A technical and strategic look at China’s app packing industry and its implications for U.S. app security. We examine how commercial protection transforms Android software, who provides it, and how these arrangements affect independent audits, supplier trust, and access to evidence.
By: Elkenson
August 31st 2026
Key findings
• Packing is widespread in the Chinese app market. A 2025 study identified packing in 58.8% of apps sampled from Chinese stores, compared with roughly 2% of the other apps in its sample.
• Cloud packing vendors receive the original Android package and return a transformed version. This gives them access to code that becomes harder for outside auditors to inspect, adding a privileged transformation step to the software supply chain.
• Vendor jurisdiction and institutional relationships matter. The report connects packing with developer identity requirements, state relationships, and restrictions on cooperation with foreign investigations. These conditions affect who can obtain evidence about software and how independently it can be assessed.
Significance
Packing can protect software against piracy and tampering while increasing the cost of investigating vulnerabilities, dependencies, and data access. Assessing an app therefore includes examining who transformed it, the conditions governing that provider, and whether meaningful independent inspection remains possible. An inventory of declared components cannot explain every change made during packing.
Methods and scope
We reviewed academic studies, vendor documentation, corporate disclosures, and legal and regulatory materials. We analyzed packing techniques, the industry’s development, provider relationships, and the implications for software auditability. Prevalence figures come from the cited researchers’ measurements.
Limitations
Packing has legitimate protective uses. The cited measurements cover particular samples and periods. The report identifies capabilities and potential risks; it does not establish that packing vendors have deliberately inserted malicious code or disclosed specific apps to state agencies.
Sources and supporting evidence
The full report contains technical studies, vendor records, corporate disclosures, regulatory sources, and references.
Suggested citation
Elkenson. “China’s App Packing Industry and U.S. App Security.” August 31, 2026.