1

Our malware scanner detected punycode as malware in /vendor/bower-asset/punycode/...

In light of punycode being used to mask some IDNs like wikipedia.org etc. I would like to know what the usage of punycode is in Craft installations.

I saw that punycode is listed under the devDependencies in /vendor/craftcms/cms/package.json however it was not installed on all of our Craft installations.

The file that's being marked as malware is:

/vendor/bower-asset/punycode/tests/data.js

2

I can't say officially (since I had nothing to do with building it), but it looks like the Punycode library specifically does this:

This library converts a Unicode encoded domain name to a IDNA ASCII form and vice-versa.

I'm not sure why it's getting flagged as malware, it seems like a pretty harmless little library. If you're still concerned about it, I'd either reach out to Pixel & Tonic directly (support@craftcms.com) or post an issue on the Punycode repo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.