Arbitrage Bots Flood GitHub as Spain Blocks Polymarket

Arbitrage Bots Dominate Today's Repo Sweep — But Read the Security Section First

Seven new repositories hit our radar today. Three are worth cloning, two are on the monitor list, and none confirmed malware — but the security picture is messier than that number suggests. Before we get to strategy, read the alerts.

---

🤖 New Bots: What's Worth Your Time

**`polymarket-weather-edge`** is the most immediately deployable find this week. The strategy is clean and specific: pull live METAR station data and Open-Meteo forecasts, compute a model probability that a temperature threshold gets hit, and fade the market when it's overpriced relative to that estimate. The NO-bias structure is smart — weather markets on Polymarket tend to price in narrative drift and recency bias, and a calibrated meteorological model should hold a persistent edge. Clone this, backtest it against the last 90 days of temperature market settlements, and size carefully.

**`polymarket-fsm-arbitrage`** is the second clone-worthy repo. It implements a finite state machine to manage the full arbitrage lifecycle — scan, evaluate, trade, exit — across related multi-outcome markets. The FSM architecture matters here: it handles the state management problem that kills most amateur arbitrage bots when one leg fills and the other doesn't. This is the right skeleton for anyone building cross-outcome position management. The strategy likely targets pricing inefficiencies between linked binary markets, which connects directly to today's alpha section.

**`pred-arbitrage`** and **`polymarket-quant-bot`** are on monitor. `pred-arbitrage` is doing cross-venue scanning across Kalshi, Polymarket, and PredictIt — useful intelligence on the state of cross-platform arb tooling, but execution risk is high given Spain's block (more below) and PredictIt's ongoing regulatory limbo. `polymarket-edge-model`'s Random Forest paper-trading setup is academically interesting but not production-ready; flag it for feature engineering ideas.

---

🚨 Security Alerts: Three Active Threats

Five alerts total today. The critical ones:

**460KB exact-size cloned malware template** is circulating. If you pull any Polymarket bot repo and the package size hits exactly 460KB, do not run it. This is a known fingerprint for a credential-harvesting template that has been reskinned and pushed across multiple accounts. Treat it as confirmed malicious until proven otherwise. Audit your current dependencies if you've cloned anything in the last 72 hours.

Two additional alerts involve **star farming campaigns** — one via garbled-username repos, one via a Telegram bot repo. These are noise and spam, not direct threats, but they're polluting GitHub search results for Polymarket tooling. If you're sourcing repos by star count, your signal is degraded right now.

---

📐 Alpha Signals: The Executable Arbitrage Problem

Two academic papers landed today that every serious operator should read.

The first distinguishes between *payoff-space* no-arbitrage and *protocol-executable* no-arbitrage in Polymarket's negative-risk markets. The finding: linked binary markets for mutually exclusive outcomes *can* violate executable arbitrage bounds before settlement, but protocol constraints prevent you from capturing it. This is the key insight — the arb exists in theory, your bot will see it, and it won't be tradeable. This directly explains why `polymarket-fsm-arbitrage` needs careful state logic around what positions are actually transformable under the protocol.

The second paper formalizes how mispriced conditional and combinatorial markets create arbitrage when you model the full condition set structure correctly. This is the theoretical foundation for building the next generation of cross-outcome bots.

The LLM-merger-outcome paper is a longer-term signal — an LLM fine-tuned on deal documents outperforming benchmarks on M&A prediction. Relevant if you're running any corporate event markets.

---

📺 What to Watch

Spain blocking Polymarket and Kalshi is the regulatory story of the week — watch for IP restriction implementations and whether Spanish volume shows up displaced to VPN traffic patterns. The Hacker News thread on the Iran missile death threats (1,606 points) is also worth reading for market manipulation and participant behavior context. The "always bet NO" bot getting 471 points is a reminder that the simplest strategies are getting mainstream attention — expect more retail copy-trading pressure on low-volatility non-sports markets.

Next 24 hours: monitor for new repos forking `polymarket-weather-edge` — first-mover advantage on a clean strategy like this is short.