Malware Campaign Targets Polymarket Bot Builders Across GitHub

Malware Campaign Hits Polymarket GitHub Ecosystem — Verify Before You Clone

The single most urgent item today is not alpha — it's a coordinated attack on the builder community. Security monitoring surfaced a multi-vector campaign pushing poisoned bot templates disguised as legitimate Polymarket tooling. If you've cloned anything from an unfamiliar repo in the last 72 hours, audit it now.

---

Security Alerts — Read First

Three related alerts landed today, and they form a coherent picture:

**Polymarket arbitrage bot malware template campaign.** This is a campaign, not an isolated repo. Attackers are publishing generic-looking arbitrage bot skeletons that likely contain credential-harvesting or wallet-draining payloads. The "arbitrage bot" framing is deliberate — it targets operators who are actively looking for edge.

**Kalshi-trade-bot (460KB exact).** A repo with a suspiciously exact 460KB binary has been flagged as probable malware. The round filesize is a known indicator of padded payloads or packed executables. Do not run it. The Kalshi brand is being used to add legitimacy.

**Garbled usernames publishing Polymarket repos.** Multiple repos traced to accounts with randomized, machine-generated usernames — a classic spam/malware distribution pattern. If the account looks like it was created last week and has three repos all named some variation of "polymarket-bot," close the tab.

This week's confirmed malware: **polymarket-insider-bot**. No strategy details are recoverable because there is no real strategy — the "insider" framing is social engineering. Do not clone, do not fork.

---

New Bots — 5 Worth Examining

**polymarket-weather-edge** — Pulls live METAR data and NOAA forecast grids, calculates daily high temperature exceedance probabilities, and fades overpriced YES positions on weather markets. Straightforward statistical approach with real data sourcing. Worth cloning if you work weather markets.

**polymarket-edge-model** — ML calibration layer using Random Forest regression trained on bid/ask spread, volume, and other market microstructure features. Outputs a true-probability estimate and trades on deviation from market price. The architecture is sound; the edge depends entirely on feature quality and training data freshness. Clone it as a framework, not a finished product.

**donmarket** — Not a trading bot. A forensic analytics tool that reverse-engineers LP fee structures and hidden costs from on-chain and API data. Underrated find. If you're providing liquidity or trying to understand why your fills are worse than they look, this is immediately useful.

**polymarket-go** — Momentum follower scoped to League of Legends markets. Tracks short-term price and volume for trend signals and trades in the direction of momentum without supervision. Flagged for monitoring, not cloning — LoL market liquidity is thin and momentum strategies in illiquid prediction markets tend to self-destruct. Watch the position sizing logic before touching it.

---

Alpha Signals — No Live Trades, But Two Papers You Should Read

No executable live trades today, but two research signals are directly actionable for bot builders:

**Negative-risk arbitrage paper.** Formalizes what experienced Polymarket operators have observed informally: linked binary markets representing mutually exclusive outcomes frequently violate no-arbitrage bounds in ways that are actually executable, not just theoretical. The key insight is that Polymarket's payoff space structure makes these violations observable in real time. If you're not already scanning condition sets for mispriced exhaustive outcomes, this is your prompt to start.

**Condition-set pricing paper.** Companion work examining how inconsistent pricing propagates across linked conditions within a single market. Both papers together describe the same exploitable structure from different angles. Implementation is non-trivial but the edge is real.

**LLM merger arbitrage paper.** A language model system achieving high accuracy on M&A outcome prediction by reasoning over full merger agreements and SEC filings. Less immediately deployable, but worth tracking if you operate in deal markets.

---

What to Watch

Spain's regulatory block on Polymarket and Kalshi is worth monitoring for contagion — if other EU jurisdictions follow, liquidity distribution shifts. The HN story about traders threatening a journalist over an Iran missile market is a reminder that high-stakes geopolitical markets carry off-platform risk that doesn't show up in your P&L. The "Nothing Ever Happens" No-bias bot hitting 471 points suggests mainstream interest in base-rate fading strategies — expect more amateur entrants in non-sports markets, which could temporarily create pricing inefficiencies to exploit.