Malware Clones Hit 4 Repos; 6 Bots Worth Stealing

Malware Spreading via Clone Templates — Stop and Read This First

Before anything else: a 460KB clone template with confirmed malware patterns has been identified in four separate repositories. The pattern is consistent across all four hits, suggesting a single bad actor seeding poisoned boilerplate into the prediction market dev ecosystem. If you cloned anything unfamiliar in the last 48–72 hours, audit it now. Check for unexpected network calls, environment variable harvesting, and anything touching your key store or wallet paths. We are not naming the repos publicly until maintainers are notified, but the signature is a 460KB template file that should not be that size. Treat any repo using that base as compromised until proven otherwise. This is the most operationally critical item in today's report.

---

New Bots: 6 Worth Cloning

**arbiter** is the lead find today. It hunts no-arbitrage violations between correlated election markets — think implied probabilities across related contracts that don't sum correctly. Sizing is fractional Kelly, and critically, it enforces a hard requirement for out-of-sample backtested edge before any live trade executes. Paper-trading is the default. This is process-first quant discipline baked into the architecture, not bolted on. Clone-worthy.

**predmarket** is infrastructure, not alpha — but valuable infrastructure. It abstracts Polymarket and Kalshi behind a unified API and includes Bayesian modeling, Monte Carlo simulation, and agent-based backtesting components. If you're building a multi-venue strategy, this is a reasonable skeleton to start from rather than writing venue adapters yourself.

**polymarket-weather-bot-poc** is a narrow but interesting proof-of-concept. It calibrates Gaussian probability models using live METAR observations and Open-Meteo forecasts, targets overpriced temperature markets, and paper-trades the NO side. The domain is limited but the methodology — real-time data calibration against market implied probabilities — transfers well to other measurable-outcome markets.

**polymarket-copybot** implements copy-trading with a quantitative trader selection layer that's more sophisticated than most. It ranks traders by net edge defined as PnL/volume minus 2.3% times spread crossings, copying only those above a threshold. Position limits and stop-losses are enforced. Keys stay local. The edge formula is worth examining regardless of whether you use the rest of the bot.

**FIFAWorldCup** is timely for 2026. Ensemble ML plus Monte Carlo simulates tournament outcomes from historical team data, then compares results to Polymarket and Kalshi odds. Tracks log-loss and Brier scores for model evaluation. Paper-trades edges. Tournament structure makes the math tractable and the market mispricings historically significant — worth running in parallel with any existing sports models.

---

Alpha Signals

Three signals worth flagging. First, a research paper proposing an agentic AI pipeline that clusters prediction markets into topical groups and detects implicit equivalences and contradictions — directly relevant to the fragmentation problem on Polymarket where overlapping questions create exploitable inconsistencies. The arbiter bot above is doing a manual version of this; automated clustering could scale it.

Second, a predict-then-contextual-optimize framework for sequential market arbitrage between day-ahead and balancing markets. The core idea — deliberately deviating from forecasts to exploit price spreads with explainable risk controls — maps cleanly onto any Polymarket scenario with related markets resolving at different times.

Third, and most theoretically significant: a paper demonstrating that apparent market randomness is endogenous, emerging from adversarial dynamics between predictive traders and the market mechanism rather than external noise. Traders learn from in-sample data while the market adapts, generating regime changes. Practical implication: your edge has a half-life, and the market is actively learning against you.

---

What to Watch

The HN story about Polymarket gamblers threatening a journalist over the Iran missile market hit 1,606 points — mainstream visibility of Polymarket toxicity is rising. Spain's block of both Polymarket and Kalshi over licensing is the more structurally important development and worth monitoring for regulatory contagion into other EU markets. The "Nothing Ever Happens" NO-bias bot at 471 points suggests retail interest in simple systematic strategies remains high — potential for crowding in low-information markets.

Priority today: audit any recent clones against the 460KB malware signature. Then pull arbiter.