
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pp-mcp-server
Advanced tools
The PayPal Model Context Protocol server allows you to integrate with PayPal APIs through function calling. This protocol supports various tools to interact with different PayPal services.
The PayPal Model Context Protocol server allows you to integrate with PayPal APIs through function calling. This protocol supports various tools to interact with different PayPal services.
To run the MCP server using npx, use the following command:
npx -y paypal-mcp
Prerequisites
node --version.If you are not familiar with how to setup MCP Servers with Claude Desktop, see this tutorial first.
Now add something like this to your Claude Desktop config:
// claude_desktop_config.json
{
"mcpServers": {
"paypal-mcp": {
"command": "npx",
"args": [
"-y",
"paypal-mcp"
],
"env": {
"PAYPAL_SERVER_SDK_LIB_ENVIRONMENT": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_TIMEOUT": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_ID": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_SECRET": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]"
}
}
}
}
You can also use VS Code to run the MCP Server. The configuration is similar to Claude Desktop. See the official docs for details.
// settings.json
{
"mcp": {
"servers": {
"paypal-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"paypal-mcp"
],
"env": {
"PAYPAL_SERVER_SDK_LIB_ENVIRONMENT": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_TIMEOUT": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_ID": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]",
"PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_SECRET": "[YOUR-ENVIRONMENT-VARIABLE-VALUE-HERE]"
}
}
}
}
}
The following environment variables can be used:
PAYPAL_SERVER_SDK_LIB_ENVIRONMENT PAYPAL_SERVER_SDK_LIB_TIMEOUT: Timeout for API calls. PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_ID PAYPAL_SERVER_SDK_LIB_O_AUTH_CLIENT_SECRET
CREATED or APPROVED status. You cannot update an order with the COMPLETED status. To make an update, you must provide a reference_id. If you omit this value with an order that contains only one purchase unit, PayPal sets the value to default which enables you to use the path: \"/purchase_units/@reference_id=='default'/{attribute-or-object}\". Merchants and partners can add Level 2 and 3 data to payments to reduce risk and payment processing costs. For more information about processing payments, see checkout or multiparty checkout. Note: For error handling and troubleshooting, see Orders v2 errors. Patchable attributes or objects: Attribute Op Notes intent replace payer replace, add Using replace op for payer will replace the whole payer object with the value sent in request. purchase_units replace, add purchase_units[].custom_id replace, add, remove purchase_units[].description replace, add, remove purchase_units[].payee.email replace purchase_units[].shipping.name replace, add purchase_units[].shipping.email_address replace, add purchase_units[].shipping.phone_number replace, add purchase_units[].shipping.options replace, add purchase_units[].shipping.address replace, add purchase_units[].shipping.type replace, add purchase_units[].soft_descriptor replace, remove purchase_units[].amount replace purchase_units[].items replace, add, remove purchase_units[].invoice_id replace, add, remove purchase_units[].payment_instruction replace purchase_units[].payment_instruction.disbursement_mode replace By default, disbursement_mode is INSTANT. purchase_units[].payment_instruction.payee_receivable_fx_rate_id replace, add, remove purchase_units[].payment_instruction.platform_fees replace, add, remove purchase_units[].supplementary_data.airline replace, add, remove purchase_units[].supplementary_data.card replace, add, remove application_context.client_configuration replace, addamount request parameter. Note: This request is currently not supported for Partner use cases.FAQs
The PayPal Model Context Protocol server allows you to integrate with PayPal APIs through function calling. This protocol supports various tools to interact with different PayPal services.
We found that pp-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.