WoompaLoompa / Woompa Loompa is on Nostr

just learning

Last Notes

2026-09-22 14:21:42 UTC

- reply

If you or your #merchants already have a @npub155m…dcvg instance, you should consider installing the #CLINK plugin https://plugin-builder.btcpayserver.org/public/plugins/clink and plug it to #ShockWallet. Easy-peasy

2026-08-31 15:18:18 UTC

#CLINK plugin for #BTCpayServer finally approved and listed in the plugin directory 🥳
Thank you @npub155m…dcvg team for your relentless feedback, I’ve learned so much more in the past two months 🙏
https://stacker.news/items/1559179/r/06bc1a977d
https://cdn.nostrcheck.me/542735574ee0a3ec4380cb363b03733c2c72ae4a5c124730a90a2301cd6f6651.png

2026-08-20 19:55:53 UTC

Hitler tries a fake L2...
https://cdn.lightning.video/0b1e6f36eff9d6108145f62cc7527154b79da930862682e8fbc8525a61acd7bd/1kwNj79WxH.mp4

2026-08-18 09:17:37 UTC

# @npub155m…dcvg #clink plugin v1.2.1 is out!
https://github.com/WoompaLoompa/btcpay-clink/releases#release-v1.2.1

2026-08-09 08:06:36 UTC

New LNbits extension: #CLINK: Recurring #Lightning Payments, #Subscriptions Auto-Renew & Funding Source for #LNbits.
Nostr-native Lightning for LNbits: publish a `noffer1...` and get paid over Nostr, pay other offers, and run **subscriptions with Lightning auto-renew** via CLINK debits. No Lightning.Pub required. A list of CLINK-aware apps is available at `clinkme.dev/apps.html`
- Offers (receive), Pay Offers (send)
- Subscriptions auto-renewal (day/week/month plans)
- Wallet debits with per-period budgets & rules
- CLINK (e.g. Lightning.pub) as funding source
Announcement: https://stacker.news/items/1543884/r/06bc1a977d
Demo: https://clink-lnbits.fly.dev/
Repo: https://github.com/WoompaLoompa/lnbits-clink
GPL-3.0, PRs, issues and any feedback welcome!
#bitcoin #nostr #asknostr

2026-08-02 08:16:42 UTC

# v1.0.9 — Security Hardening (BOLT11 validation + guest-order authorization)
### Summary
This release closes three security gaps identified in a plugin review: invoices were accepted without being validated against the order's network/amount/expiry, guest orders had no ownership check on the payment AJAX handlers, and `save_ndebit` trusted a client-supplied subscription ID.
Download and install from:
- GitHub https://github.com/WoompaLoompa/woo-clink/releases/tag/v1.0.9
- Wordpress https://wordpress.org/plugins/clink-gateway-for-woocommerce/
### Security fixes
- **Strict BOLT11 invoice validation** — the invoice is parsed server-side (bech32 checksum, HRP network, amount, expiry) before payment is confirmed. Invoices that are invalid, on the wrong network, for an amount that doesn't match the order total (within 1 sat), or that expire in under 60 seconds are rejected in the checkout UI.
- **Guest order-key authorization** — all four payment AJAX handlers (`check_payment`, `confirm_payment`, `mark_paid`, `save_ndebit`) now require the matching order key for guest orders; logged-in users must match the order's customer ID. Previously guests could confirm/mark any order.
- **Server-side subscription binding** — `save_ndebit` no longer accepts a client-supplied `subscription_id`; subscription IDs are derived server-side from the verified order.
### New
- **Network setting** (`mainnet` / `testnet` / `regtest`) added to the gateway configuration; invoices from a different network are rejected.
- Parsed invoice amount is recorded as `_clink_invoice_amount_sats` order meta.
### Install / Update
1. Upload/install `clink-gateway-for-woocommerce.zip` (attached) or update from the WordPress.org plugin page.
2. WordPress 5.8+ / WooCommerce 3.0+ / PHP 7.4+ (tested up to WP 7.0.2).
3. If you're on testnet or regtest, set **Bitcoin Network** in **WooCommerce → Settings → Payments → Lightning (CLINK)** so invoices are validated against the right chain.
https://cdn.nostrcheck.me/f4c1e3f156654869f7886d4b273f7cdc59a38f84423b7827f85720c803fae801.png

2026-08-01 12:20:23 UTC

# v1.0.2 update released in GH and npm
### Security Hardening
- BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
- Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
- Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
- SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
- nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
- k1 correlation key on debit requests (<subscription_id>:<count>)
### Added
- webhookSecret and merchantPubkey configuration options
- payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
- bolt11 and nostr-tools dependencies
- Expanded test suite (130 tests, 5 suites) with coverage thresholds met
npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/medusa-clink
.
https://cdn.nostrcheck.me/22050ade6bf1e05509f5f21ce3fbc370b8663c7cf725af1b40188c73cc237c14.png

2026-08-01 12:19:31 UTC

# vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released
Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink
### What's new in v0.3.0
- Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
- Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
- Invoice expiry validation — already-expired invoices are refused
- SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
- Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
- Atomic offer transitions — settlement/expiry only applies from pending state
- Event kind 21001 + p-tag correlation checks on relay receipts
- Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).
I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues
#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink
https://cdn.nostrcheck.me/22050ade6bf1e05509f5f21ce3fbc370b8663c7cf725af1b40188c73cc237c14.png

2026-07-28 09:31:52 UTC

https://image.nostr.build/468ad07580387737efa8cd735ad5128a38d607651bac50b4d7ef7c46a48700ae.png
MedusaJS is one of the fastest-growing open-source eCommerce frameworks, but despite its explosive growth in headless commerce, no Bitcoin Lightning module existed for MedusaJS. Until now. Built a MedusaJS module that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via npm and GitHub.
Read more:
- https://stacker.news/items/1534561/r/06bc1a977d
- https://yakihonne.com/article/s/06bc1a977d@stacker.news/GyoUX3dJzUCaHQFyhrd1x
#bitcoin #commerce #ecommerce #lightning #clink #medusajs

2026-07-28 09:19:14 UTC

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink
![](https://m.stacker.news/149911)
Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol.
Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).
**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.
**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential
**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)
**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.
**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```
```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```
**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.
**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki
Feedback welcome. Happy to answer any questions.
https://stacker.news/items/1534561

2026-07-28 09:14:03 UTC

Bitcoin Lightning payments for MedusaJS eCommerce via CLINK
https://github.com/WoompaLoompa/medusa-clink
![](https://m.stacker.news/149911)
Built a MedusaJS plugin that enables Bitcoin Lightning payments for online stores using the CLINK protocol. Available via [npm](https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink) and [GitHub](https://github.com/WoompaLoompa/medusa-clink).
**The gap:**
[MedusaJS](jttps://https://medusajs.com) is one of the fastest-growing open-source eCommerce frameworks ([35K+ stars](https://github.com/medusajs/medusa) on GitHub, claimed [$10B+ GMV](https://unsubbed.co/tools/medusa/) global, [~150K monthly](https://next-levels.de/en/medusa/) `npm` downloads). Despite explosive growth in headless commerce, no Bitcoin Lightning plugin existed for MedusaJS. Until now.
**Market context:**
- Bitcoin payments ecosystem: $8.7B in 2026, projected $53.65B by 2035 (22.4% CAGR) — MarkWide Research
- Lightning Network: $1.17B monthly volume, 266% YoY growth — River State of Lightning Report
- Lightning avg transaction size doubled to $223 (up from $118) — River
- Square opened Lightning to 4M US merchants with zero processing fees — Square
- 8/10 crypto holders hold for investment, only ~20% use for shopping — huge untapped merchant adoption potential
**What it does:**
- Accept Lightning payments on any MedusaJS store
- Self-custodial: merchant optionally runs their own Lightning.pub node, no third-party custody
- Instant settlement via Lightning Network
- QR code + one-click copy for invoices payments
- Auto currency conversion (CoinGecko, Kraken, Fixed rate, or manual)
- Subscriptions via nDebit recurring payments that activate automatic renewals.
- Dual confirmation: Webhook (primary) + Polling (backup)
**Why CLINK?**
[CLINK](https://stacker.news/items/1248472/r/06bc1a977d) (Common Lightning Interface for Nostr Keys) uses Nostr as transport layer with no web server required for your Lightning node if you chose Bootstrap on [ShockWallet.app](ShockWallet.app). Self-custodial by design when you opt-in running your [Lightning.pub](https://Lightning.pub) node. Ephemeral keys for payment requests = better privacy than traditional payment processors.
**Quick start:**
```
npm install medusa-plugin-bitcoin-lightning-via-clink
```
```typescript
// medusa-config.ts
{
resolve: "medusa-plugin-bitcoin-lightning-via-clink",
id: "clink",
options: {
noffer: "noffer1...", // Your CLINK offer
currencySource: "coingecko"
}
}
```
**Advantage:**
Traditional card payments cost merchants 2-3% per transaction. Lightning costs a fraction of a cent. Let's not even consider all telemetry and tracking that can be done by third parties on all your fiat payments, done and received. CLINK offers zero traceability without any traceable HTTP/HTTPS calls. For a small business processing thousands of transactions/month, the savings are material. Plus: no chargebacks, instant settlement, no waiting for batch processing, it just works, 24/7, 365 days a year non stop.
**Links:**
- npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
- GitHub: https://github.com/WoompaLoompa/medusa-clink
- Wiki: https://github.com/WoompaLoompa/medusa-clink/wiki
Feedback welcome. Happy to answer any questions.
https://stacker.news/items/1534561

2026-07-13 05:04:18 UTC

Just dropped the #CLINK Payments Gateway for #Wordpress : Auto-renew subscriptions via Bitcoin Lightning, finally.
No third-party processor. No webhooks. No HTTP requests. No server for your node. Just a noffer, a Nostr relay, and the ndebit protocol doing the heavy lifting.
Merchants: generate a noffer1... in your CLINK wallet, paste it in WooCommerce, go.
https://image.nostr.build/faa669f5ee89256acaec9d313506f806637aa3f8ef15672d3a0965494130d792.png
Customers: scan a QR, pay, authorize auto-renewal once, never think about it again.
https://image.nostr.build/75aa43c42a7c1f4dfb6dd4cf6621c29e46616ec81836efcdad7297700ceeae3a.png
Recurring Lightning payments, fully self-sovereign.
Demo: https://woo-clink.wasmer.app
Code: https://github.com/WoompaLoompa/woo-clink
#Bitcoin #LightningNetwork #Nostr #WooCommerce #CLINK

2026-07-13 04:58:37 UTC

Setup #CLINK plugin to enable #lightning payments Aupo-Renew for your @npub155m…dcvg 's Subscription plans.
Customers simply add a nDebit string to authorize future subscription plan payments
https://blossom.primal.net/d609905deef648b7c8e57f5d6111b2d6f05de3548f1a1d6051ab426e578f8ba3.png

2023-09-23 05:50:02 UTC

# ⚡️🤙
https://void.cat/d/W9GRqs6DbUsiqpJ3zXx7u1.webp