
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
hardhat-deploy
Advanced tools
Hardhat plugin for replicable smart contract deployments and easy testing across multiple EVM chains, with support for proxies, diamonds, named accounts, and deployment fixtures
A Hardhat Plugin For Replicable Deployments And Easy Testing
Note: This is the documentation for hardhat-deploy v2 that works with hardhat v3
Documentation for hardhat-deploy v1 can be found on the v1 branch
hardhat-deploy makes it easy for you to deploy your EVM smart contracts across many chains while keeping track of them and replicating the same environment for testing.
It adds a mechanism to associate names to addresses, so test and deployment scripts can be reconfigured by simply changing the address a name points to. This results in much clearer tests and deployment scripts — no more accounts[0] in your code.
While Hardhat's official Ignition plugin offers a robust deployment system, it comes with a rigid DSL that limits flexibility. hardhat-deploy + rocketh provides:
deployViaProxy for upgradeable contracts, including support for OpenZeppelin transparent proxies.diamondCut for you.@rocketh/export) — listing deployed contracts' addresses and their ABIs (useful for web apps)Version 2 is a full rewrite that has been used in production for several years. It is fully modular, making it much easier to contribute new deployment mechanisms.
Under the hood, hardhat-deploy uses rocketh, a framework-agnostic system that provides a minimal API to save and load deployments. Everything else is handled by external modules:
@rocketh/deploy — provides a deploy function to deploy contracts@rocketh/proxy — deploy proxies declaratively like in hardhat-deploy v1@rocketh/diamond — deploy diamonds declaratively@rocketh/read-execute — helpers for reading and executing transactions@rocketh/viem — viem client integrationYou can also provide your own modules for advanced use cases.
import { deployScript, artifacts } from "../rocketh/deploy.js";
export default deployScript(
async ({ deployViaProxy, namedAccounts }) => {
const { deployer, admin } = namedAccounts;
await deployViaProxy(
"GreetingsRegistry",
{
account: deployer,
artifact: artifacts.GreetingsRegistry,
args: ["prefix:"],
},
{
owner: admin,
},
);
},
{ tags: ["GreetingsRegistry"] },
);
Please find the full documentation here
If you're migrating from hardhat-deploy v1 to v2 and want to use AI to help with the process, check out our SKILL.md file. This comprehensive guide is designed for AI assistants and includes detailed instructions for systematic migration, code transformation rules, and troubleshooting guidance.
Get started quickly with the template-ethereum-contracts template that provides a production-ready setup with hardhat-deploy and rocketh.
MIT
If you find this project useful, please consider sponsoring it! Your support helps me continue developing and maintaining this tool.
FAQs
Hardhat plugin for replicable smart contract deployments and easy testing across multiple EVM chains, with support for proxies, diamonds, named accounts, and deployment fixtures
The npm package hardhat-deploy receives a total of 29,680 weekly downloads. As such, hardhat-deploy popularity was classified as popular.
We found that hardhat-deploy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.