
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
github.com/jsmvalente/lndrouting
Advanced tools
ldRouting is the reference implementation of lightning distributed routing. The software is written in golang and in its current state it's capable of:
The following animation illustrates how a route is computed using the LDR protocol.

When Alice wants to find a path to Bob she sends a routing probe through the network. With the help of the routing tables kept locally by the nodes the probe collects the correct path and its associated data. When the probe reaches the destination (Bob), it returns to the sender with the routing information.
The following instalation instructions are for running ldRouting using bitcoin's testnet.
In order to build ldRouting you'll need to download Go. The minimum supported version is Go 1.14. We recommend using the latest version of Go, which at the time of writing is 1.14.
To build ldRouting run the following commands:
git clone https://github.com/jsmvalente/ldRouting
cd ldRouting
go install
ldRouting depends on bitcoind and lnd as backend implementations of the bitcoin and lightning protocols.
The following is an example of a bitcoin.conf file that can be used to setup bitcoind for ldRouting.
listen=1
testnet=1
txindex=1
server=1
zmqpubrawblock=tcp://127.0.0.1:28332
zmqpubrawtx=tcp://127.0.0.1:28333
rpcuser=MY_RPC_USER
rpcpassword=MY_RPC_PASS
[test]
rpcbind=127.0.0.1
rpcallowip=127.0.0.1
deprecatedrpc=signrawtransaction
lnd can also be configured by using the following lnd.conf file.
[Application Options]
externalip=MY_IP_ADDRESS
# tlsextraip=MY_IP_ADDRESS
# tlsextradomain=MY_DOMAIN
[Bitcoin]
bitcoin.active=true
bitcoin.testnet=true
bitcoin.node=bitcoind
[Bitcoind]
bitcoind.rpcuser=MY_RPC_USER
bitcoind.rpcpass=MY_RPC_PASS
bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
The LDR protocol uses the IP addresses announced by nodes in the lightning network to connect to its peers, so to be able to route payments to your node you should need to set externalip correctly.
If you're connecting to remotely your lightning node remotely you will need to setup tlsextraip or tlsextradomain. After setting one of those configuration options you'll need to restart lnd to regenerate your tls.cert.
To call ldRouting from anywhere you'll need to add its location to your $PATH enviroment variable:
export PATH=$PATH:$GOPATH/bin
Then you'll be able to start ldRouting using:
ldRouting -<option>=<VALUE>
The available options are:
bitcoinRPCUser=<Bitcoin core RPC user> (required)
bitcoinRPCPassword=<Bitcoin core RPC password> (required)
bitcoinClientHost=<Bitcoin core host address> (default: localhost)
bitcoinClientPort=<Bitcoin core host port> (default: 18332)
lightningClientHost=<LND host address> (default: localhost)
lightningClientPort=<LND host port> (default: 10009)
macaroonPath=<Path to the macaroon used with LND for authenticate> (default: $HOME/.lnd/data/chain/bitcoin/mainnet/admin.macaroon)
tlsCertPath=<Path to the TLS certificate used with LND for authentication> (default: $HOME/.lnd/tls.cert)
port=<Port to listen for new connections to the routing client> (default: 8695)
dataPath=<Path to directory holding the application's data> (default: $HOME/.ldRouting/data")
So normally you could start ldRouting by doing:
./ldRouting -bitcoinRPCUser=MY_RPC_USER -bitcoinRPCPassword=MY_RPC_PASS
Note: This software is still highly unstable and not ready for production. A bitcoind regtest environment is recommended.
Pull requests are welcome. For major changes, please open an issue or a draft PR first to discuss what you would like to change.
Please make sure to update tests as appropriate.
I'm always one DM away @piggydeveloper.
If twitter is not your thing drop me an e-mail here.
This software is released under the terms of the MIT license. For more see https://opensource.org/licenses/MIT.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.