<p>I can't say officially (since I had nothing to do with building it), but it looks like the <a href="https://github.com/true/php-punycode" rel="nofollow noreferrer">Punycode library</a> specifically does this:</p>

<blockquote>
  <p>This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.</p>
</blockquote>

<p>I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel &amp; Tonic directly (support@craftcms.com) or post an <a href="https://github.com/true/php-punycode/issues" rel="nofollow noreferrer">issue</a> on the Punycode repo.</p>

CC BY-SA 4.0
2019-01-19T22:42:21.080Z
2019-01-19T22:42:21.080Z
Lindsey D
<p>Our malware scanner detected punycode as malware in <code>/vendor/bower-asset/punycode/...</code></p>

<p>In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.</p>

<p>I saw that punycode is listed under the <code>devDependencies</code> in <code>/vendor/craftcms/cms/package.json</code> however it was not installed on all of our Craft installations.</p>

<p>The file that's being marked as malware is:</p>

<p><code>/vendor/bower-asset/punycode/tests/data.js</code></p>

<craft3>
Craft CMS usage of punycode
# Craft CMS usage of punycode

(Asked by: username_0 on 2019-01-19)

Our malware scanner detected punycode as malware in `/vendor/bower-asset/punycode/...`

In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.

I saw that punycode is listed under the `devDependencies` in `/vendor/craftcms/cms/package.json` however it was not installed on all of our Craft installations.

The file that's being marked as malware is:

`/vendor/bower-asset/punycode/tests/data.js`

**Tags:** craft3

---

## 1 answers

### Answer by username_1 on 2019-01-19. Score: 2

I can't say officially (since I had nothing to do with building it), but it looks like the [Punycode library](https://github.com/true/php-punycode) specifically does this:

> This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.

I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel & Tonic directly (support@craftcms.com) or post an [issue](https://github.com/true/php-punycode/issues) on the Punycode repo.


---

