
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
LibKa: one Markdown file to a web page, A4 PDF, 16:9 slides and Word file, each checked for accessibility by Guard and signed. The libka command.
LibKa turns one Markdown file into a web page, an A4 PDF, 16:9 slides and an editable Word file. Guard checks every output for accessibility (axe-core WCAG 2.2 A/AA in Chrome, text contrast 4.5:1 and 7:1 in high contrast, LibKa's structure rules, reflow at 320 CSS pixels, PDF/UA-1 with veraPDF, the Word file's structure), and the outputs that pass are signed.
npm create libka@latest my-docs
The starter has an example document, npm scripts, a CI workflow and a README of next steps.
npm install --save-dev @libka/cli
npx libka doctor # what this computer has: Node.js 22.18+, Chrome; optional Java with veraPDF
npx libka build docs/guide.md # the outputs the document asks for, checked by Guard and signed
| Command | What it does |
|---|---|
libka build <file.md> [--out <dir>] [--outputs web,pdf,deck,docx] | builds, checks with Guard and signs; stops with file:line on a problem |
libka lint <file.md> [--json] | reads the source only, in a couple of seconds: problems, outline, slide hints |
libka check <page.html> | Guard on any HTML page |
libka verify <page.html> [--pdf <file>] [--docx <file>] [--require-trusted] | the signature, the files unchanged since signing, the checks passed, and whether the key is trusted; --require-trusted also fails when the signing key is not trusted (the project's .libka/trusted-keys.json, or LibKa's own list when the project has none), so a CI job can refuse an output signed by an unknown key |
libka studio [--port <n>] [--dir <folder>] | LibKa Studio, the local-first editor, on http://localhost:5178/ (or the port given); --dir serves a Studio built somewhere else |
libka doctor | what is installed, what works without each missing piece, and where to get it |
libka --version | the version (2.0.0) |
Requirements: Node.js 22.18 or newer and Google Chrome (Guard runs in it, and it prints the PDFs). Java 21 with veraPDF is optional: without it, PDFs are built and their manifest says they were not validated against PDF/UA-1.
Signing: each project (the nearest folder above the document with .libka/, else the nearest with package.json or .git) gets its own key in .libka/signing-key.pem at its first build, with a .libka/.gitignore that keeps it out of git; the first key is listed as trusted in .libka/trusted-keys.json (commit that file).
Documentation, the block catalog and the source: https://github.com/aivigator-ai/open-libka-design-platform
Licence: Apache-2.0. LibKa is a product name of its publisher, which the licence does not grant (see NOTICE).
FAQs
LibKa: one Markdown file to a web page, A4 PDF, 16:9 slides and Word file, each checked for accessibility by Guard and signed. The libka command.
The npm package @libka/cli receives a total of 0 weekly downloads. As such, @libka/cli popularity was classified as not popular.
We found that @libka/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.