npm-zoo is a curated repository that maintains a comprehensive list of known malicious NPM packages. The tool serves as a reference database for identifying potentially harmful packages within the NPM ecosystem. The repository provides detailed information about each malicious package, including identification methods and avoidance strategies. It functions as a threat intelligence resource specifically focused on supply chain security for JavaScript and Node.js projects. npm-zoo enables developers and security teams to cross-reference their project dependencies against known malicious packages. The tool helps prevent the inclusion of compromised packages that could introduce security vulnerabilities or malicious code into applications. The resource is maintained as a collaborative effort to track and document malicious NPM packages as they are discovered. It provides both historical data on past threats and current information on newly identified malicious packages in the NPM registry.