# npm-zoo

npm-zoo is a Software Supply Chain Security product. It runs in the cloud. Pricing is free.

npm-zoo is a curated database of known malicious NPM packages that helps developers and security researchers identify and avoid potentially harmful dependencies in their projects.

Checked October 2026.

## What is npm-zoo?

npm-zoo is a curated repository that maintains a comprehensive list of known malicious NPM packages. The tool serves as a reference database for identifying potentially harmful packages within the NPM ecosystem.

The repository provides detailed information about each malicious package, including identification methods and avoidance strategies. It functions as a threat intelligence resource specifically focused on supply chain security for JavaScript and Node.js projects.

npm-zoo enables developers and security teams to cross-reference their project dependencies against known malicious packages. The tool helps prevent the inclusion of compromised packages that could introduce security vulnerabilities or malicious code into applications.

The resource is maintained as a collaborative effort to track and document malicious NPM packages as they are discovered. It provides both historical data on past threats and current information on newly identified malicious packages in the NPM registry.

Tags: npm, Security Research, Node.js, Supply Chain Security, Package Security, Threat Feed

## Where it fits in your security program (NIST CSF 2.0)

- [Govern](https://cybersectools.com/guides/building-govern-program-small-team): helps you set security rules, owners and oversight.
- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Software Supply Chain Security](https://cybersectools.com/categories/software-supply-chain-security)
- Deployment: Cloud
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 20
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best Application Security Solutions for Business](https://cybersectools.com/shortlists/best-application-security-solutions).

## npm-zoo FAQ

### What is npm-zoo?

npm-zoo is a product in the Software Supply Chain Security category. It covers npm, Security Research and Node.js.

### What is the pricing for npm-zoo?

npm-zoo is free. Download and setup instructions are at https://github.com/spaceraccoon/npm-zoo/.

### What are alternatives to npm-zoo?

Alternatives to npm-zoo listed on CybersecTools:

1. [Hunted Labs](https://cybersectools.com/tools/hunted-labs) - Detects foreign adversarial influence in open source software dependencies. (Commercial)
2. [Varnish Artifact Firewall](https://cybersectools.com/tools/varnish-artifact-firewall) - Package firewall that blocks malicious and vulnerable open-source packages before install (Commercial)
3. [Corridor Shai Hulud 2.0 Detector](https://cybersectools.com/tools/corridor-shai-hulud-20-detector) - Client-side tool to check npm projects for Shai Hulud 2.0 supply chain compromise. (Free)
4. [Aikido Software Supply Chain Security](https://cybersectools.com/tools/aikido-software-supply-chain-security) - Software supply chain security platform detecting malware in dependencies (Commercial)
5. [Socket](https://cybersectools.com/tools/socket) - Detects and blocks malicious/vulnerable open source packages in supply chains. (Commercial)

Compare all npm-zoo alternatives at [https://cybersectools.com/alternatives/npm-zoo](https://cybersectools.com/alternatives/npm-zoo)

### What deployment and organization size does npm-zoo fit?

npm-zoo is available as a cloud service. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare npm-zoo with similar solutions

- [npm-zoo vs Hunted Labs](https://cybersectools.com/compare/hunted-labs-vs-npm-zoo)
- [npm-zoo vs Varnish Artifact Firewall](https://cybersectools.com/compare/npm-zoo-vs-varnish-artifact-firewall)
- [npm-zoo vs Corridor Shai Hulud 2.0 Detector](https://cybersectools.com/compare/corridor-shai-hulud-20-detector-vs-npm-zoo)

All alternatives to npm-zoo: [/alternatives/npm-zoo](https://cybersectools.com/alternatives/npm-zoo)

---

Source: https://cybersectools.com/tools/npm-zoo

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on npm-zoo: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md