Answers.Body: <p>I can't say officially (since I had nothing to do with building it), but it looks like the <a href="https://github.com/true/php-punycode" rel="nofollow noreferrer">Punycode library</a> specifically does this:</p>
  
  <blockquote>
    <p>This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.</p>
  </blockquote>
  
  <p>I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel &amp; Tonic directly (support@craftcms.com) or post an <a href="https://github.com/true/php-punycode/issues" rel="nofollow noreferrer">issue</a> on the Punycode repo.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-01-19T22:42:21.080Z
Answers.LastActivityDate: 2019-01-19T22:42:21.080Z
Answers.UserDisplayName: Lindsey D
Body: <p>Our malware scanner detected punycode as malware in <code>/vendor/bower-asset/punycode/...</code></p>
  
  <p>In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.</p>
  
  <p>I saw that punycode is listed under the <code>devDependencies</code> in <code>/vendor/craftcms/cms/package.json</code> however it was not installed on all of our Craft installations.</p>
  
  <p>The file that's being marked as malware is:</p>
  
  <p><code>/vendor/bower-asset/punycode/tests/data.js</code></p>
  
Tags: <craft3>
Title: Craft CMS usage of punycode
ThreadText: # Craft CMS usage of punycode
  
  (Asked by: username_0 on 2019-01-19)
  
  Our malware scanner detected punycode as malware in `/vendor/bower-asset/punycode/...`
  
  In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.
  
  I saw that punycode is listed under the `devDependencies` in `/vendor/craftcms/cms/package.json` however it was not installed on all of our Craft installations.
  
  The file that's being marked as malware is:
  
  `/vendor/bower-asset/punycode/tests/data.js`
  
  **Tags:** craft3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-01-19. Score: 2
  
  I can't say officially (since I had nothing to do with building it), but it looks like the [Punycode library](https://github.com/true/php-punycode) specifically does this:
  
  > This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.
  
  I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel & Tonic directly (support@craftcms.com) or post an [issue](https://github.com/true/php-punycode/issues) on the Punycode repo.
  
  
  ---
  
  