Craft CMS usage of punycode
I can't say officially (since I had nothing to do with building it), but it looks like the Punycode library specifically does this:


  This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.


I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel &amp; Tonic directly (support@craftcms.com) or post an issue on the Punycode repo.