Kalshi-Polymarket Arb Kit Lands; Malware Clone Confirmed

Kalshi/Polymarket Arb Kit Is the Real Find Today

Seven repos surfaced in today's scan, all seven rated worth cloning — but `harlanljones/arbkit` is the standout. It does real-time order book comparison between Kalshi and Polymarket in Rust, targeting inter-market arbitrage across equivalent contracts. The language choice matters: Rust gives you the latency profile you need to actually close these spreads before they collapse. If you're already running infrastructure on one platform, this is the fastest path to cross-platform edge. Clone it, audit the order book ingestion layer, and validate that the Kalshi API bindings are current before you touch live capital.

New Bots: Full Breakdown

**`nadnad250/polymarket-bot`** — Ensemble ML stack (LightGBM + XGBoost + LSTM) predicting short-term BTC price direction for Polymarket's 5-minute Up/Down markets. Three-model ensembles on 5-min windows are a reasonable approach but watch for overfitting on the LSTM layer; these markets are noisy enough that a miscalibrated sequence model will bleed fast.

**`tamzid2001/polymarketfuturesbot`** — Automated scalping on US Futures prediction markets using technical indicators for trend and momentum with immediate order execution. Thin strategy documentation, but the execution architecture is worth examining for anyone already running momentum systems.

**`midas93230-cell/donmarket`** — Not a trading bot. This is a fee reverse-engineering tool that analyzes execution data to reconstruct what market-making services are actually charging. Valuable for operators doing cost attribution across venues. Run it against your own execution history before you benchmark competitors.

**`BallesJr/polymarket-edge-model`** — Random Forest regression model for probability calibration, identifying mispriced markets by comparing model output to implied prices. Classic approach, solid foundation. The value is in the feature engineering — check what inputs they're feeding the forest before deciding whether to extend or replace the model layer.

Security: Confirmed Malware — Hard Stop

This is not advisory language: a confirmed malware template is in circulation today. The fingerprint is a **460KB exact-size clone**. If a repo you're evaluating hits that file size exactly and matches the template structure, do not run it. Two separate alerts flagged this package — one for the malware itself, one noting it's also running a star-farming campaign to manufacture credibility. The star-farming is the mechanism: inflated stars push it into search results, operators assume social proof equals safety. It does not. Cross-reference file sizes before executing anything locally, and run unknown repos in an isolated environment with no wallet keys or API credentials present.

Separately, a broader star-farming campaign is targeting Polymarket Telegram bots. Treat star counts on Telegram-distributed bots as noise until you've read the source.

Alpha: Arbitrage Structure Papers Worth Reading

Two research papers on Polymarket's arbitrage conditions are circulating. The more actionable finding: Polymarket's negative-risk markets create **observable but potentially non-executable** no-arbitrage violations. Linked binary markets representing mutually exclusive outcomes show price inconsistencies that exist in payoff space but may not be closable before settlement due to platform-level position constraints. Know the difference before you build a strategy around it — the spread is real, the trade may not be.

The third paper is on LLM-driven merger arbitrage forecasting. A system using expert-guided context engineering and finetuning over M&A documents achieved high accuracy on deal outcome prediction. Relevant if you're trading acquisition-related markets; the methodology is transferable.

What to Watch

Spain's block of both Polymarket and Kalshi over gambling licensing is the regulatory story with the longest tail. One jurisdiction moving formally creates a template others can follow. If you're running volume through EU-adjacent infrastructure, start mapping your exposure now. The HN thread on the Iran missile story death threats is noise for operators but signal for platform risk — Polymarket's visibility is high enough that adverse resolution events now generate mainstream blowback. That affects market maker behavior around geopolitical contracts.