
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
CLI for decoding Phantasma Carbon + VM transactions, contract lifecycle scripts, event hex payloads, ROM blobs, and address conversions.
fromCROWN formatbytes32 addresses to Phantasma addresses and back# global install
npm i -g pha-decode
# local development install
npm install
npm run build
# inspect CLI help or version
pha-decode --help
pha-decode --version
pha-decode <txHex>
pha-decode tx --hex <txHex>
pha-decode tx --hash <txHash> [--rpc <url>]
pha-decode event --hex <eventHex> [--kind <kind>]
pha-decode rom --hex <romHex> [--symbol <symbol>] [--token-id <tokenId>] [--rom-format <mode>]
pha-decode address --bytes32 <hex>
pha-decode address --pha <address>
--format <json|pretty>: output format, default pretty--vm-detail <all|calls|ops|none>: VM detail level, default all--carbon-detail <all|call|msg|none>: Carbon detail level, default call--carbon-addresses <bytes32|pha>: render known Carbon addresses as raw bytes32 or decoded Phantasma addresses, default bytes32--protocol <number>: protocol version used for built-in interop ABI selection, default latest known protocol--rpc <url>: RPC endpoint for --hash--resolve: fetch contract metadata from RPC and merge it into method resolution--abi <path>: ABI JSON file or directory to merge into method resolution--verbose: enable SDK logging--version: print the package version--help: print CLI helpMode-specific flags:
--kind <eventKind>--symbol <symbol>--token-id <tokenId>--rom-format <auto|legacy|crown>--bytes32 <hex>--pha <address>pha-decode tx --hex accepts either:
SignedTxMsg hex stringIt does not accept payload-only RPC fields such as carbonTxData. If you only have a tx hash or an RPC response, use:
pha-decode tx --hash <txHash> --rpc <url>
If the decoded Carbon transaction contains a nested VM transaction, pha-decode extracts it automatically.
pha-decode now enriches deploy / upgrade interops in VM output.
For Runtime.DeployContract and Runtime.UpgradeContract, the decoded output includes:
vm.methodCalls[].summary
kindfromcontractNamecontractScriptcontractABIvm.methodCalls[].args[].details
byteLengthsha256instructionCount when disassembly succeedsbyteLengthsha256methodCounteventCountThis makes pha-decode useful as a companion to pha-deploy contract deploy --dry-run and pha-deploy contract upgrade --dry-run.
Decode a tx hash via RPC:
pha-decode tx --hash 155422A6882C3342933521DDC1A335292BF6448DBD489ED0BE21CFC74AFBA52A \
--rpc https://pharpc1.phantasma.info/rpc \
--format json \
--carbon-addresses pha \
--vm-detail calls \
--carbon-detail call
Decode a local tx hex or raw VM script:
pha-decode 0xDEADBEEF...
Decode a deploy / upgrade dry-run transaction generated elsewhere:
pha-decode tx --hex <SIGNED_TX_HEX> --vm-detail calls --format pretty
Decode classic event hex:
pha-decode event --hex 0xAABBCC... --kind TokenMint
Decode ROM in auto mode:
pha-decode rom \
--hex 220100F100396A4B73E3ABCD6B9039712944D7DF9E8ABE7211E519A91176E83A28D01B10027965 \
--symbol CROWN \
--token-id 80367770225206466995541877216191568684251978941303868068127874072614271067693
Force the legacy/common ROM parser:
pha-decode rom --hex 0x... --rom-format legacy
Convert Carbon bytes32 to a Phantasma address:
pha-decode address --bytes32 f100396a4b73e3abcd6b9039712944d7df9e8abe7211e519a91176e83a28d01b
Convert a Phantasma address back to Carbon bytes32:
pha-decode address --pha P2KKzrLNZK75f4Vtp4wwWocfgoqywBo3zKBWxBXjLgbxXmL
JSON output is stable and machine-friendly:
{
"source": "tx-hash",
"input": "155422A6...",
"rpc": { "url": "https://...", "method": "getTransaction" },
"carbon": { "...": "..." },
"vm": { "...": "..." },
"event": { "...": "..." },
"rom": { "...": "..." },
"address": { "...": "..." },
"warnings": [],
"errors": []
}
Notes:
carbon.call is the human-readable Carbon call decodecarbon.msg is the raw Carbon payload decodevm.instructions and vm.methodCalls are controlled by --vm-detail--carbon-addresses pha only converts known address-shaped Carbon fieldsThis repo ships a justfile with:
just buildjust testjust r <args>just d <args>Use just --list to inspect the full local helper set.
--resolve requires --rpcgetContracts is incomplete, unresolved methods fall back to raw dataFAQs
Phantasma transaction, contract, ROM, and event decoder CLI
The npm package pha-decode receives a total of 26 weekly downloads. As such, pha-decode popularity was classified as not popular.
We found that pha-decode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.