Seven in Ten PayPal Server SDK Installs Are Deprecated

PayPal's current server-side SDK is installed about 646,913 times a month across npm and PyPI. The packages it replaced are installed 1,514,750 times.

That is 2.34 superseded installs for every current one, and 70.1% of all 2,161,663 monthly installs of PayPal's server-side libraries. Two of the superseded packages carry npm's own machine-readable deprecation flag.

What the registry says out loud

npm lets a maintainer mark a package deprecated, and the message comes back with every install. PayPal has used it twice.

@paypal/checkout-server-sdk and paypal-rest-sdk both return "Package no longer supported. The author suggests using the @paypal/paypal-server-sdk package instead." Between them they are installed 412,595 times a month.

paypal-rest-sdk last shipped a release on 4 December 2017. That is 3,234 days, or 8.9 years, and it still draws 176,107 installs a month. A third package, @paypal/payouts-sdk, was last released on 28 September 2021 and carries no flag at all; it draws 111,347.

The replacement, @paypal/paypal-server-sdk, first published on 9 September 2024, shipped six releases in the last twelve months, the most recent on 21 August 2026. It draws 616,164 installs a month — a clear majority of the four, but only just: 54%.

Only two of the three older packages are formally deprecated, so it is worth asking whether the headline survives without @paypal/payouts-sdk, which covers a different API and carries no flag. Drop it and the superseded share across both ecosystems falls from 70.1% to 68.5%. The finding does not depend on it.

Python is a different story

On PyPI the same migration has barely started.

paypalrestsdk was last released on 1 November 2023. Its summary field on PyPI reads, in full, "Deprecated". It is installed 990,808 times a month.

paypal-server-sdk, the current library, released on the same day as its Node counterpart and five times in the last year, is installed 30,749 times a month.

That is 97.0% of PayPal's Python server-SDK installs going to the package the company says not to use. On npm the figure is 46.0%.

The rest of the industry looks healthier

HaiPay measured thirty-three packages in all: the official server SDKs of fifteen payment providers, eighteen on npm and fifteen on PyPI. Together they are installed 157,856,021 times a month.

Stripe is 86.3% of that on its own. Its Python package shipped ninety releases in the last twelve months, one every four days.

HaiPay measured Stripe's npm share at 92.9% three weeks ago, against a narrower set of nine gateway SDKs. Across the eighteen npm packages here it is 87.7%. The difference is the denominator — this set adds Plaid, Mercado Pago, Dwolla, Midtrans, Xendit, Coinbase Commerce and four PayPal packages — not a change in Stripe.

Thirteen of the thirty-three packages had no release in the last year. But they account for only 1.31% of installs — and that number is doing a lot of hiding, because Stripe's volume drowns everything. Set Stripe aside and the share of installs going to packages with no release in a year is 9.5%.

Seven packages were last released before 2024. They total 1,548,162 installs a month, and PayPal's four are 1,514,750 of them. On this measure, the ageing of the payment SDK layer is almost entirely one company's.

Node ships first

Fourteen providers in the set publish an SDK in both ecosystems. For eight of them the Node package is the fresher one; for two it is Python. The median package on npm last shipped 97 days ago, the median on PyPI 167.

The gaps can be wide. Dwolla's Node client last shipped 111 days ago and its Python client 391. Midtrans: 496 days against 1,090. Coinbase Commerce: 6.5 years against 8.2.

Four pairs break the pattern by releasing on exactly the same day — Square on 15 September 2026, PayPal's current SDK on 21 August 2026, Xendit on 29 May 2025, Authorize.Net on 28 April 2025. Same-day pairs across two ecosystems are what machine-generated SDKs look like: one API specification, many languages, one release button. Where that pipeline exists, Python does not fall behind. Where it does not, it does.

Why this matters

A deprecated SDK does not stop working on the day it is deprecated. It stops getting fixes. When the provider rotates a certificate, retires a cipher suite, changes an error shape or sunsets an endpoint, an integration pinned to a 2017 library finds out in production.

The useful thing about registry data is that it measures the migration rather than the announcement. PayPal shipped the replacement on 9 September 2024 and flagged the old Node packages in the one place every developer's tooling reads automatically. Two years and a month later, most of the installs are still going the other way.

For anyone running a payments integration, the question the numbers pose is narrow and answerable: which package is in your lockfile, and when did it last ship?

What this is not

Download counts are installs, not projects and not merchants. They include continuous-integration runs, container rebuilds, mirrors and automated traffic. A single busy build pipeline can account for thousands of them. Nothing here is a count of live integrations.

A package with no recent release is not necessarily abandoned. A small, complete library may simply have nothing to ship. The three npm deprecation flags are the only explicit statements of intent in the data; everything else is inference from dates.

The provider list is HaiPay's, chosen for regional coverage rather than market share, and it is not exhaustive. Browser-side packages were excluded, which is why PayPal's front-end libraries — @paypal/paypal-js at 3.5 million installs a month and @paypal/react-paypal-js at 2.0 million, both actively released — are not in these totals.

Figures were taken once, on 12 October 2026. Both download endpoints report a rolling window that moves daily.

HaiPay did not contact PayPal or any other provider named here.

What to watch

Whether the ratio flips. The current Node SDK already leads its three predecessors; the Python one is thirty-two times behind. If PayPal yanks or further restricts the old releases, both numbers will move fast, and the registries will show it within a month.

Whether other providers adopt the deprecation flag. Three packages out of thirty-three use it. It is free, machine-readable, and the only part of this dataset that does not require interpretation.

And whether the same-day pairs spread. Four providers now release Node and Python together. That is the cheapest available signal that an SDK programme is automated rather than maintained by hand — and automated programmes are the ones that do not leave a library in 2017.