Craft CMS usage of punycode Our malware scanner detected punycode as malware in /vendor/bower-asset/punycode/...

In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.

I saw that punycode is listed under the devDependencies in /vendor/craftcms/cms/package.json however it was not installed on all of our Craft installations.

The file that's being marked as malware is:

/vendor/bower-asset/punycode/tests/data.js
I can't say officially (since I had nothing to do with building it), but it looks like the Punycode library specifically does this:


  This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.


I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel &amp; Tonic directly (support@craftcms.com) or post an issue on the Punycode repo.