
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
CLI for Phantasma token flows and contract lifecycle workflows.
Current surface area:
--create-token--create-series--mint-fungible--mint-nftcontract compilecontract deploycontract upgradecontract attach--version prints both the pha-deploy version and the resolved pha-tomb version/path.>=16pha-tomb >= 2.1.0 must be available for contract compile, either in PATH or through --compiler / PHA_TOMB_PATHcontract deploy, contract upgrade, and contract attach do not invoke the compiler directly. They work from a compiled artifact bundle or explicit --script / --abi inputs.
# global install
npm i -g pha-deploy
# inspect the installed CLI and compiler binding
pha-deploy --version
# local development install
npm install
npm run build
node dist/cli.js --help
Example version output:
pha-deploy 0.5.0
pha-tomb version 2.1.0
pha-tomb path /usr/local/bin/pha-tomb
pha-deploy contract <compile|deploy|upgrade|attach> [options]
pha-deploy --create-token [options]
pha-deploy --create-series [options]
pha-deploy --mint-fungible [options]
pha-deploy --mint-nft [options]
Token actions still support the config-first TOML flow.
Typical setup:
cp config/config.example.toml config.toml
pha-deploy --create-token --config config.toml
Common token flags:
--config <path>: load TOML config, default config.toml--dry-run: build/sign but do not broadcast--rpc-log: enable SDK JSON-RPC logging--settings-log: print the resolved configuration before execution--rpc <url>--nexus <name>--wif <wif>--symbol <symbol>--token-type <nft|fungible>--token-max-supply <int>--fungible-max-supply <int>--fungible-decimals <0..255>--carbon-token-id <int>--phantasma-series-id <int>--mint-fungible-to <address>--mint-fungible-amount <int>--rom <hex>--token-schemas <json>--token-metadata <json>--series-metadata <json>--nft-metadata <json>--create-token-max-data <int>--create-token-series-max-data <int>--mint-token-max-data <int>--gas-fee-base <int>--gas-fee-create-token-base <int>--gas-fee-create-token-symbol <int>--gas-fee-create-token-series <int>--gas-fee-multiplier <int>Required token inputs by action:
--create-token
rpc, nexus, wif, symboltoken_schemastoken_max_supply and fungible_decimals--create-series
carbon_token_id, token_schemas, series_metadata--mint-nft
carbon_token_id, phantasma_series_id, token_schemas, nft_metadata--mint-fungible
carbon_token_id, mint_fungible_amountmint_fungible_to defaults to the signer address when omittedseries_metadata and nft_metadata accept either:
name -> value{ "name": "...", "value": ... }Compile a .tomb source file through pha-tomb from PATH, or pin an exact local compiler with --compiler / PHA_TOMB_PATH.
pha-deploy contract compile \
--source ./contracts/demo.tomb \
--compiler /path/to/pha-tomb \
--out ./dist/contracts/demo \
--debug \
--protocol 16 \
--nativecheck warn
Supported compile flags:
--source <path>: required .tomb source file--compiler <path>: optional explicit pha-tomb executable path; takes precedence over PHA_TOMB_PATH and PATH--out <dir>: final artifact bundle directory--contract-name <name>: required when the compiler emits multiple modules and you need to pick one--protocol <number>: passed through to pha-tomb--debug: request debug artifacts--nativecheck <off|warn|error>--libpath <path>: repeatable additional library search pathPHA_TOMB_PATH=/path/to/pha-tomb is also supported when --compiler is omitted and you want to avoid whichever pha-tomb happens to be first in PATH.
Compile output:
pha-tomb stdout / pha-tomb stderrmanifest.json<contract>.pvm<contract>.abi<contract>.debug<contract>.asm<contract>.pvm.hex<contract>.abi.hexmanifest.json is the preferred handoff format for later deploy/upgrade/attach commands.
Deploy a compiled contract bundle.
Using the manifest produced by contract compile:
pha-deploy contract deploy \
--rpc https://testnet.phantasma.info/rpc \
--nexus testnet \
--chain main \
--wif <WIF> \
--manifest ./dist/contracts/demo/manifest.json \
--dry-run
Using explicit artifact paths instead of a manifest:
pha-deploy contract deploy \
--rpc https://testnet.phantasma.info/rpc \
--nexus testnet \
--wif <WIF> \
--contract-name demo \
--script ./dist/contracts/demo/demo.pvm \
--abi ./dist/contracts/demo/demo.abi
Upgrade an already deployed contract using the same artifact inputs:
pha-deploy contract upgrade \
--rpc https://testnet.phantasma.info/rpc \
--nexus testnet \
--chain main \
--wif <WIF> \
--manifest ./dist/contracts/demo/manifest.json \
--dry-run
Attach a compiled VM contract bundle to an already existing token symbol:
pha-deploy contract attach \
--rpc https://testnet.phantasma.info/rpc \
--nexus testnet \
--chain main \
--wif <WIF> \
--manifest ./dist/contracts/demo/manifest.json \
--symbol DEMO \
--dry-run
When --symbol is omitted, contract attach defaults to the bundle contract name from the manifest or direct artifact inputs.
Shared deploy/upgrade/attach flags:
--rpc <url>: required--nexus <name>: required--chain <name>: optional, defaults to main--wif <wif>: required--manifest <path>: preferred compiled bundle input--contract-name <name>: required when using direct --script / --abi--script <path>: compiled .pvm--abi <path>: compiled .abi--debug <path>: optional .debug--gas-price <int>--gas-limit <int>--pow <int>--payload-hex <hex>--dry-runAttach-only flag:
--symbol <symbol>: existing token symbol to attach to; defaults to the bundle contract name when omittedDeploy/upgrade output always includes:
Attach output also prints the resolved token symbol used for the interop call.
When --dry-run is omitted, the CLI also broadcasts the transaction, waits for the tx result, and prints the tx hash.
Create an NFT token from config:
pha-deploy --create-token --config ./config.toml
Mint fungible tokens without editing the config file:
pha-deploy --mint-fungible \
--config ./config.toml \
--carbon-token-id 123 \
--mint-fungible-amount 100000000
Compile, then deploy from the emitted manifest:
pha-deploy contract compile --source ./contracts/demo.tomb
pha-deploy contract deploy \
--rpc https://testnet.phantasma.info/rpc \
--nexus testnet \
--wif <WIF> \
--manifest ./dist/contracts/demo/manifest.json \
--dry-run
This repo ships a justfile with the current documented shortcuts:
just buildjust testjust ctjust ctfjust ctdjust csjust csdjust mnjust mndjust mfjust mfdRun just --list to inspect the full local helper set.
FAQs
CLI for Phantasma token and contract lifecycle workflows
The npm package pha-deploy receives a total of 460 weekly downloads. As such, pha-deploy popularity was classified as not popular.
We found that pha-deploy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.