
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
lvconnect copies your CGM data from LibreView web services to a Nightscout website. The tool runs as node.js index.js, or as a Nightscout plugin, and will atempt to connect to your LibreView account, fetch data and upload to your Nightscout website via its REST API.
VARIABLE (default) - description
API_SECRET - A secret passphrase that must be at least 12 characters long, and must match the API_SECRET from your Nightscout websiteWEBSITE_HOSTNAME - The hostname for your Nightscout website. Example: sitename.herokuapp.com or sitename.azurewebsites.net. Do not include http:// or https://LVCONNECT_SERVER (api.libreview.io)- LibreView api website. ['EU', 'US', or any actual hostname]. Blank value can be used to get redirect LibreView servers in the US. Set to (EU) to fetch from servers outside of US from the beginning.LVCONNECT_USER_NAME - Your personal account email for the Pro LibreView service. Overrides LVCONNECT_PRO_USER_NAME if set. Can be left empty if Pro account is used (see below).LVCONNECT_PASSWORD - Your personal password for the Pro LibreView service. Overrides LVCONNECT_PRO_PASSWORD if set. Can be left empty if Pro account is used (see below).LVCONNECT_TRUSTED_DEVICE_TOKEN - Trusted device token for 2FA verificationLVCONNECT_PRO_USER_NAME - Account email for the Pro LibreView service.LVCONNECT_PRO_PASSWORD - Password for the Pro LibreView service.LVCONNECT_PRO_TRUSTED_DEVICE_TOKEN - Pro account's trusted device token for 2FA verificationLVCONNECT_PATIENT_ID - LibreView Pro connected patient UUID. Used with Pro accounts to access one of the connected patients data. Ignored for personal LibreView accounts.LVCONNECT_INTERVAL (3600000) - The time (in milliseconds) to wait between each update. Default is 1 hourLVCONNECT_FETCH_TIMEOUT (2000) - Number of millisecods to wait for the LibreView servers' responseLVCONNECT_MAX_FAILURES (3) - The maximum number of attempts to connect to the LibreView server.LVCONNECT_FIRST_FULL_DAYS (90) - The number of days to search for data on the first update only.NS - A fully-qualified Nightscout URL (e.g. https://sitename.herokuapp.com) which overrides WEBSITE_HOSTNAMELVCONNECT_TIME_OFFSET_MINUTES - Time difference in MINUTES between UTC and your location. LibreView treats your local time as UTC and doesn't report the actual time differences, so data will be shown with wrong timestamps if this parameter is not set.Before sending over and sensitive user information lvconnect checks if the LVCONNECT_SERVER appears to be a valid Lvapi server, then logs in and fetches historical glucose data through the Daily Log report. This information is then uploaded to the user's specified WEBSITE_HOSTNAME or NS.
If called without any parameters as a stand-alone tool, or as a plugin lvconnect will fetch data accumulated since previous call every LVCONNECT_INTERVAL ms, except for the the first run when it will request all data in the last LVCONNECT_FIRST_FULL_DAYS. Only essential step information is printed out.
The following three command line parameters are used for development and debugging:
login - forces starting of a new login session and fetches new authentication token.fetch - prevents fetched data from being uploaded to Nightscout, and saves it to fetched.json instead.run - runs one full authorize/fetch/upload cycle.In development mode lvconnect only fetches data once per call, and its current session is saved to a session.json file and is resused for next calls. It also re-uses authentication tokens until they expire, or obtaines new ones as required.
Deletion of the session.json file will enforce new session start.
Click 'Deploy to Heroku' button above and configure all of the variables as per descriptions, then click 'Deploy app'.
After the app is built and started click 'Manage app' button or go to Overview tab, then click 'Configure Dynos' link. Disable 'web' and enable 'worker' processes, confirm changes. Lvconnect does not have web interface when used as a standalone tool, and having 'web' process will cause app crashes.
Make sure that you correctly set LVCONNECT_TIME_OFFSET_MINUTES variable, as LibreView is not using timezones internally and therefore there is no way for lvconnect to know what your local time is. LVCONNECT_TIME_OFFSET_MINUTES is set in minutes to accomodate 1/2 hour timezones, not in hours!
The code is lisensed under GNU General Public License.
This project is not approved by any national Health Authority, not recommended for therapy, and not related to, or approved by LibreView / Abbott.
FAQs
Fetches data from LibreView's webservice and puts it in Nightscout
We found that lvconnect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.