npm-zoo is a curated database of known malicious NPM packages that helps developers and security researchers identify and avoid potentially harmful dependencies in their projects.
Checked October 2026.
npm-zoo is a curated repository that maintains a comprehensive list of known malicious NPM packages. The tool serves as a reference database for identifying potentially harmful packages within the NPM ecosystem.
The repository provides detailed information about each malicious package, including identification methods and avoidance strategies. It functions as a threat intelligence resource specifically focused on supply chain security for JavaScript and Node.js projects.
npm-zoo enables developers and security teams to cross-reference their project dependencies against known malicious packages. The tool helps prevent the inclusion of compromised packages that could introduce security vulnerabilities or malicious code into applications.
The resource is maintained as a collaborative effort to track and document malicious NPM packages as they are discovered. It provides both historical data on past threats and current information on newly identified malicious packages in the NPM registry.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about npm-zoo: features, pricing and alternatives.
npm-zoo is a product in the Software Supply Chain Security category. It covers npm, Security Research and Node.js.
npm-zoo is free. Download and setup instructions are at https://github.com/spaceraccoon/npm-zoo/.
Alternatives to npm-zoo listed on CybersecTools:
Compare all npm-zoo alternatives at https://cybersectools.com/alternatives/npm-zoo
npm-zoo is available as a cloud service. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Automated SBOM generation and management platform for software supply chain
Binary code analysis platform for software supply chain security and SBOM gen.
A Python script that scans Nexus Repository Manager for artifacts with identical names across repositories to identify dependency confusion attack vulnerabilities.
A tool that safely installs packages with npm/yarn by auditing them as part of your install process.
Octoscan is a static analysis tool that scans GitHub Actions workflows for security vulnerabilities and misconfigurations.
Secures SDLC with malware detection, vuln scanning, SBOM gen & secret detection
On our shortlist?
No shortlist covers this product's category yet. The closest is Best Application Security Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
