
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
lightning-backends
Advanced tools
Module to integrate with various Lightning Network node software and service providers
Node.js module to integrate with various Lightning Network node software and service providers.
The following list includes all the Lightning Network node software and service providers which are supported:
Add to your application via npm:
npm install lightning-backends
const { checkBackend, prepareBackend } = require('lightning-backends');
const backend = 'lnd';
const config = {
hostname: '127.0.0.1:8080',
protocol: 'https',
cert: '/path/to/lnd/tls.cert',
macaroon: '/path/to/lnd/admin.macaroon',
};
const ln = prepareBackend(backend, config);
// Pay a Lightning invoice.
ln.payInvoice(invoice).then(result => {
// `{ id: null }`
// `{ id: 'custom-unique-identifier' }`
console.log('payInvoice OK', { result });
}).catch(error => {
console.error('payInvoice FAILED:', { error });
});
// Request a new Lightning invoice from the backend.
ln.addInvoice(21000/* msat */).then(result => {
// `{ id: null, invoice: <bolt11-invoice> }`
// `{ id: 'custom-unique-identifier', invoice: <bolt11-invoice> }`
console.log('addInvoice OK', { result });
}).catch(error => {
console.error('addInvoice FAILED:', { error });
});
// Get the current status of an invoice by its payment hash or unique identifier.
// Some backends require the use of a unique identifier instead of payment hash.
// If the `addInvoice` method returns an `id` then use tha instead of the payment hash here.
ln.getInvoiceStatus(paymentHash).then(result => {
// `{ preimage: null, settled: false }`
// `{ preimage: '23b1a130cdc61f869674fdc4a64e8de5da1d4666', settled: true }`
console.log('getInvoiceStatus OK', { result });
}).catch(error => {
console.error('getInvoiceStatus FAILED:', { error });
});
// Get current spendable Lightning balance.
ln.getBalance().then(result => {
// `result` will be the balance in millisatoshis.
console.log('getBalance OK', { result });
}).catch(error => {
console.error('getBalance FAILED:', { error });
});
// Open a new channel.
// Most backends do not support this method.
ln.openChannel(remoteId, localAmt, pushAmt, makePrivate).then(result => {
// `result` can vary depending upon the backend used.
console.log('openChannel OK', { result });
}).catch(error => {
console.error('openChannel FAILED:', { error });
});
// Attempt to pay a 1000 msat invoice for a randomly generated node private key.
// Since the node doesn't exist, it will always fail.
// If the error is "no_route" or some other similar error, then the check is passed.
// Failed authentication or any unexpected errors are considered a failed check.
checkBackend(backend, config, { method: 'payInvoice' }).then(result => {
console.log('Backend configuration check', result.ok ? 'OK' : 'FAILED', { result });
});
Lightning Network Daemon (lnd):
127.0.0.1:8080esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onionhttps://127.0.0.1:8080/custom/pathhttp://esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onion/custom/path/path/to/lnd/tls.cert - As a file path.{ data: 'STRING_UTF8_ENCODED' } - As a string.{ data: Buffer.from('STRING_UTF8_ENCODED', 'utf8') } - As a buffer./path/to/lnd/admin.macaroon - As a file path.{ data: 'STRING_HEX_ENCODED' } - As a string.{ data: Buffer.from('STRING_HEX_ENCODED', 'hex') } - As a buffer.127.0.0.1:9050C-Lightning (unix sock):
/path/to/unix/sock/.lightning/lightning-rpcC-Lightning (Sparko):
https://127.0.0.1:9737/rpchttp://esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onion/rpc--sparko-keys= in your lightningd config.coinos:
https://coinos.iolnbits:
https://legend.lnbits.comlndhub:
lndhub://login:password@baseurllnpay:
lntxbot:
opennode:
It is possible to define your own custom backend to use with this module. To do so, create a new file and save it in your project:
// ./backends/custom.js
const { LightningBackend } = require('lightning-backends/lib');
class Backend extends LightningBackend {
static name = 'custom';
constructor(options) {
super(Backend.name, options, {
defaultOptions: {
customOption1: 'a default value',
},
requiredOptions: ['customOption1'],
});
}
checkOptions(options) {
// This is called by the constructor.
// Throw an error if any problems are found with the given options.
}
getNodeUri() {
// Options are available as follows:
const { customOption1 } = this.options;
return Promise.reject('Not implemented');
}
openChannel(remoteId, localAmt, pushAmt, makePrivate) {
return Promise.reject('Not implemented');
}
payInvoice(invoice) {
return Promise.reject('Not implemented');
}
addInvoice(amount, extra) {
return Promise.reject('Not implemented');
}
getInvoiceStatus(paymentHash) {
return Promise.reject('Not implemented');
}
};
module.exports = Backend;
Then to use your custom backend:
const { prepareBackend } = require('lightning-backends');
const backend = './backends/custom.js';
const config = {};
const ln = prepareBackend(backend, config);
ln.payInvoice(invoice).then(() => {
console.log('payInvoice OK', { result });
}).catch(error => {
console.error('payInvoice FAILED:', { error });
});
Run automated tests as follows:
npm test
See CHANGELOG.md
This software is MIT licensed:
A short, permissive software license. Basically, you can do whatever you want as long as you include the original copyright and license notice in any copy of the software/source. There are many variations of this license in use.
FAQs
Module to integrate with various Lightning Network node software and service providers
The npm package lightning-backends receives a total of 86 weekly downloads. As such, lightning-backends popularity was classified as not popular.
We found that lightning-backends demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.