
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
lightning-backends
Advanced tools
Module to integrate with various Lightning Network node software and service providers
Node.js module to integrate with various Lightning Network node software and service providers.
The following list includes all the Lightning Network node software and service providers which are supported:
Add to your application via npm:
npm install lightning-backends
const { checkBackend, prepareBackend } = require('lightning-backends');
const backend = 'lnd';
const config = {
hostname: '127.0.0.1:8080',
protocol: 'https',
cert: '/path/to/lnd/tls.cert',
macaroon: '/path/to/lnd/admin.macaroon',
};
const ln = prepareBackend(backend, config);
// Pay a Lightning invoice.
ln.payInvoice(invoice).then(result => {
// `{ id: null }`
// `{ id: 'custom-unique-identifier' }`
console.log('payInvoice OK', { result });
}).catch(error => {
console.error('payInvoice FAILED:', { error });
});
// Request a new Lightning invoice from the backend.
ln.addInvoice(21000/* msat */).then(result => {
// `{ id: null, invoice: <bolt11-invoice> }`
// `{ id: 'custom-unique-identifier', invoice: <bolt11-invoice> }`
console.log('addInvoice OK', { result });
}).catch(error => {
console.error('addInvoice FAILED:', { error });
});
// Get the current status of an invoice by its payment hash or unique identifier.
// Some backends require the use of a unique identifier instead of payment hash.
// If the `addInvoice` method returns an `id` then use tha instead of the payment hash here.
ln.getInvoiceStatus(paymentHash).then(result => {
// `{ preimage: null, settled: false }`
// `{ preimage: '23b1a130cdc61f869674fdc4a64e8de5da1d4666', settled: true }`
console.log('getInvoiceStatus OK', { result });
}).catch(error => {
console.error('getInvoiceStatus FAILED:', { error });
});
// Get current spendable Lightning balance.
ln.getBalance().then(result => {
// `result` will be the balance in millisatoshis.
console.log('getBalance OK', { result });
}).catch(error => {
console.error('getBalance FAILED:', { error });
});
// Open a new channel.
// Most backends do not support this method.
ln.openChannel(remoteId, localAmt, pushAmt, makePrivate).then(result => {
// `result` can vary depending upon the backend used.
console.log('openChannel OK', { result });
}).catch(error => {
console.error('openChannel FAILED:', { error });
});
// Attempt to pay a 1000 msat invoice for a randomly generated node private key.
// Since the node doesn't exist, it will always fail.
// If the error is "no_route" or some other similar error, then the check is passed.
// Failed authentication or any unexpected errors are considered a failed check.
checkBackend(backend, config, { method: 'payInvoice' }).then(result => {
console.log('Backend configuration check', result.ok ? 'OK' : 'FAILED', { result });
});
Lightning Network Daemon (lnd):
127.0.0.1:8080esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onionhttps://127.0.0.1:8080/custom/pathhttp://esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onion/custom/path/path/to/lnd/tls.cert - As a file path.{ data: 'STRING_UTF8_ENCODED' } - As a string.{ data: Buffer.from('STRING_UTF8_ENCODED', 'utf8') } - As a buffer./path/to/lnd/admin.macaroon - As a file path.{ data: 'STRING_HEX_ENCODED' } - As a string.{ data: Buffer.from('STRING_HEX_ENCODED', 'hex') } - As a buffer.127.0.0.1:9050C-Lightning (unix sock):
/path/to/unix/sock/.lightning/lightning-rpcC-Lightning (Sparko):
https://127.0.0.1:9737/rpchttp://esdlkvxdkwxz6yqs6rquapg4xxt4pt4guj24k75pdnquo5nau135ugyd.onion/rpc--sparko-keys= in your lightningd config.coinos:
https://coinos.iolnbits:
https://legend.lnbits.comlndhub:
lndhub://login:password@baseurllnpay:
lntxbot:
opennode:
It is possible to define your own custom backend to use with this module. To do so, create a new file and save it in your project:
// ./backends/custom.js
const { LightningBackend } = require('lightning-backends/lib');
class Backend extends LightningBackend {
static name = 'custom';
constructor(options) {
super(Backend.name, options, {
defaultOptions: {
customOption1: 'a default value',
},
requiredOptions: ['customOption1'],
});
}
checkOptions(options) {
// This is called by the constructor.
// Throw an error if any problems are found with the given options.
}
getNodeUri() {
// Options are available as follows:
const { customOption1 } = this.options;
return Promise.reject('Not implemented');
}
openChannel(remoteId, localAmt, pushAmt, makePrivate) {
return Promise.reject('Not implemented');
}
payInvoice(invoice) {
return Promise.reject('Not implemented');
}
addInvoice(amount, extra) {
return Promise.reject('Not implemented');
}
getInvoiceStatus(paymentHash) {
return Promise.reject('Not implemented');
}
};
module.exports = Backend;
Then to use your custom backend:
const { prepareBackend } = require('lightning-backends');
const backend = './backends/custom.js';
const config = {};
const ln = prepareBackend(backend, config);
ln.payInvoice(invoice).then(() => {
console.log('payInvoice OK', { result });
}).catch(error => {
console.error('payInvoice FAILED:', { error });
});
Run automated tests as follows:
npm test
See CHANGELOG.md
This software is MIT licensed:
A short, permissive software license. Basically, you can do whatever you want as long as you include the original copyright and license notice in any copy of the software/source. There are many variations of this license in use.
FAQs
Module to integrate with various Lightning Network node software and service providers
We found that lightning-backends demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.