Malware
Packer
Packer is a wrapper that compresses or encrypts a program and restores it in memory only when it runs. Scanners that read the file on disk see the wrapper, not the code inside.
How it is measured
Look for a small stub plus a large high-entropy blob. In JavaScript the stub is usually an eval(function(p,a,c,k,e,d) pattern or an atob call feeding Function. In binaries, tools report packer names, unusual section names, and entropy near the maximum in a data section.
Confirm by unpacking: run the sample in a sandbox and dump the code after the stub finishes, or evaluate the decoder with the final eval replaced by a print. The packed file's hash changes on every repack even when the payload does not.
Worked example
A browser-script scanner flags a 9 KB file on a florist's Astro site as packed. The file starts with eval(function(p,a,c,k,e,d){...}) and a pipe-separated dictionary. Swapping eval for console.log in a throwaway Node session prints 5.8 KB of plain JavaScript that appends an iframe to document.body.
Two weeks later a second copy appears with a different dictionary and a different length, yet unpacking yields the same iframe code. The file hash differed; the behavior did not.
How it differs
Obfuscation is any technique that hides meaning, including renaming and string tricks. A packer is a specific kind that stores the real code compressed or encrypted and unpacks it at run time. If you can read the logic after pretty-printing, it was obfuscated; if the real code only exists after execution, it was packed.
Common errors
Treating every packed file, such as some commercial installers and minified bundles, as malware by default. Matching only on the packer's name, which attackers change. Trusting a hash blocklist when each build repacks. Unpacking on a live production host. Stopping at the first layer when there are several.
In practice
When a scanner says packed, unpack once in a sandbox, then write your detection around the unpacked behavior: the URL it contacts, the elements it injects. Hash lists age quickly against a packer, so pair them with pattern rules on decoded output.