Security alerts250

Every flagged repo, what was found and why it matters. Check any bot against this list before you run it.

• CampaignNov 12, 2026

  Garbled-username Polymarket spam campaign

  Five repos flagged GARBLED_USERNAME (connectcomputers/arb-bot, toobigtofailbot-maker/polymarket-strategy-lab, coreyjoshuamiller/prediction-market-public-metrics, gabrieltoribiopereira/panel-polymarket, aguamarinac2-netizen/quant-polymarket-trackrecord) share the pattern of auto-generated/randomized usernames, 0 stars/forks, all updated 2026-11-12, and inflated or oddly proportioned repo sizes (6KB to 77MB). Consistent spam/low-quality campaign footprint — avoid cloning or running.

• SpamNov 12, 2026github.com/toobigtofailbot-maker/polymarket-strategy-lab

  Empty-description strategy lab with 12MB payload

  toobigtofailbot-maker/polymarket-strategy-lab has a blank description, garbled username, 12,349 KB (~12MB) size, and 0 stars/forks. Large opaque payload with no README context in a zero-reputation account is a common carrier for bundled payloads or scraped tooling; do not execute without inspection.

• Suspicious DependencyNov 12, 2026github.com/hurside69/Polymarket-Perpetual-Bot

  Topic-stuffed bot with keyword spam in metadata

  hurside69/Polymarket-Perpetual-Bot lists 20 near-duplicate Polymarket/ai/trade keywords in topics (ai-forecasting-polymarket, ai-prediction-polymarket, ... trade-ai-polymarket) — a keyword-stuffing pattern used to surface in searches. 49 stars/8 forks on a 3-week-old repo. Treat 'paper trading' promises as unverified and do not connect live Kalshi/Polymarket API keys.

• ScamNov 12, 2026github.com/aguamarinac2-netizen/quant-polymarket-trackrecord

  'Demo campaign' track record repo presents as live bot

  aguamarinac2-netizen/quant-polymarket-trackrecord claims append-only ledger and SHA-256 manifest but the description reveals it is a 'campana demo 15d' (15-day demo). Repos presenting demo/paper results as a 'track record' can be used to solicit copy-trading or subscription funds. Verify any trades against on-chain CLOB data before engaging.

• Fake StarsNov 12, 2026github.com/bennyjo/phil

  Possible star farming on bennyjo/phil

  bennyjo/phil has 250 stars and 171 forks (68% fork ratio) with 0 pre-existing reputation, 485MB repo size, and topic stuffing for ai-agents/olas/polymarket discoverability. Flag POSSIBLE_STAR_FARMING. Fork-heavy, oversized repo with marketing keywords is a classic fake-engagement pattern to inflate visibility of a Polymarket trading agent; treat listed paper-edges and 'Pearl Connect' integration claims as unverified.

• CampaignSep 15, 2026

  Polymarket Bot Spam Wave — Updated Same Day

  All seven flagged repos were updated on 2026-09-15 (today), across unrelated owners with zero or near-zero stars, collectively targeting Polymarket/Kalshi/BTC 5m–15m arbitrage. Simultaneous update across disjoint accounts with no real community traction suggests a coordinated spam/malware distribution wave using trending prediction-market keywords.

• ScamSep 15, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Topic-Stuffed Fake Arbitrage Bot — polyGrid

  fitting-immunoglobulinm376/polyGrid (5.5MB Rust) has wildly irrelevant topics mixed in: 'airfoil', 'cfd', 'dividing-polynomials', 'flexbox', 'interpretability', 'recomender-system' (misspelled) alongside 'polymarket-arbitrage-tarding-bot' (typo). This keyword-stuffing pattern is used to surface the repo in unrelated search queries and is a hallmark of fake/scam tooling rather than legitimate trading software. GARBLED_USERNAME flag also present.

• CampaignSep 15, 2026github.com/Juanp2389/Kalshi-trade-bot

  460KB Clone Fingerprint Malware Template (Second Instance)

  Juanp2389/Kalshi-trade-bot matches the same 460KB exact-size malware template as Aidenb2931/polymarket-bot (CLONE_FINGERPRINT_460KB). Description claims TypeScript Kalshi/Polymarket arbitrage but language field is 'unknown' — a strong indicator of repackaged malware. Tagged with inflated topic lists including 'kalshi-ai-entry-bot', 'kalshi-ai-kalshi-trader' used for search poisoning.

• ScamSep 15, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled Username Rust Bot — Polymarket-5min-bot

  savarahypersomnia96/Polymarket-5min-bot claims a Rust high-frequency 5-minute up/down arbitrage bot. GARBLED_USERNAME flag plus heavily keyword-stuffed topics ('btc-5m-bot', 'scalping', 'ai', 'binance') indicate a search-poisoning distribution account. No stars and zero forks for a claimed high-frequency trading tool is a red flag.

• SpamSep 15, 2026

  Garbled Username Spam Campaign — PolyMarket/Jockey Bots

  Multiple repos (connectcomputers/arb-bot, savarahypersomnia96/Polymarket-5min-bot, Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker, fitting-immunoglobulinm376/polyGrid) use GARBLED_USERNAME flag — randomly generated or concatenated word handles characteristic of automated spam/malware distribution accounts. All created/updated in a narrow July–September 2026 window targeting Polymarket/Kalshi arbitrage keywords.

• ScamSep 15, 2026github.com/connectcomputers/arb-bot

  Garbled Username + Arbitrage Hype Repo

  connectcomputers/arb-bot (502KB Python, GARBLED_USERNAME, zero stars/forks) claims cross-venue arbitrage across Polymarket/Kalshi/Limitless — a common lure for credential-stealing and wallet-draining payloads. Username pattern 'connectcomputers' with a zero-history account and pre-screening GARBLED_USERNAME flag indicates a likely malicious lure repo.

• ScamSep 15, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Garbled Username Spreadmaker Bot

  Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker (1MB TypeScript, GARBLED_USERNAME) uses classic keyword-stuffing topics including 'mev', 'bundle', 'amms', 'bsc' mixed with Polymarket arbitrage claims. Garbled account name and the absence of stars/forks on a claimed profitable MEV-adjacent strategy indicate a lure/scam repo.

• CampaignSep 15, 2026github.com/Aidenb2931/polymarket-bot

  460KB Clone Fingerprint Malware Template

  Repos Aidenb2931/polymarket-bot and Juanp2389/Kalshi-trade-bot both flagged with CLONE_FINGERPRINT_460KB, matching the known malware pattern of exact 460KB size repos used as confirmed cloned malware templates. Both have generic prediction-market bot descriptions with language 'unknown', created months apart but updated same day (2026-09-15), indicating coordinated refresh. Avoid cloning or executing any code from these repos.

• SpamSep 12, 2026github.com/connectcomputers/arb-bot

  arb-bot repo with garbled username and zero history

  connectcomputers/arb-bot (created 2026-08-11, updated 2026-09-12, Python, 762KB, GARBLED_USERNAME flag, zero stars, zero forks, empty topics) advertises cross-venue 'Arbitrage bot Polymarket/Kalshi/Limitless' with no README verification surface, no stars, and a handle that reads as machine-generated. Fits the garbled-username Polymarket spam wave updated on 2026-09-12. Do not install; any README curl-pipe-bash or npm install step is high-risk for credential exfiltration against Polymarket/Kalshi API keys.

• ScamSep 12, 2026github.com/marketlenstrade/polymarket-historical-data

  Historical-data lure repo with GARBLED_USERNAME and external 'full archive' redirect

  marketlenstrade/polymarket-historical-data (created and updated 2026-09-12, size 152365 KB) advertises 'Free Polymarket historical data ... Full archive at marketlens.trade' and pairs the offer with a 'marketlens Python SDK'. GARBLED_USERNAME flag set. Pattern combines (a) a large binary payload (152MB Parquet/CSV) that is impractical to audit before use, (b) an off-GitHub funnel URL (marketlens.trade) to capture downstream traffic into an unvetted SDK, and (c) a same-day creation/update timestamp typical of throwaway spam infrastructure. The 'free data + SDK' structure is a classic lure to convince quant traders to install an unverified package. Do not install the marketlens SDK and do not follow the marketlens.trade redirect.

• CampaignSep 12, 2026github.com/Juanp2389/Kalshi-trade-bot

  Same 460KB clone template re-used for Kalshi-trade-bot

  Juanp2389/Kalshi-trade-bot matches the exact 460KB malware template fingerprint (CLONE_FINGERPRINT_460KB pre-screening flag) identical to Aidenb2931/polymarket-bot. Language field is 'unknown', created 2026-04-19 (nearly 3 months before the clone twin) but updated 2026-09-12 in lockstep with the other clone — indicating a coordinated re-publish/update cycle. Description advertises 'TypeScript arbitrage bot' for 'Kalshi BTC 15m markets' but the repository language is unknown, contradicting the claim. Same campaign as the Aidenb2931 repo. Do not clone; do not run any install scripts referenced in the README.

• CampaignSep 12, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact-size Polymarket/Kalshi bot malware template clone

  Two unrelated repos share the exact 460KB size fingerprint matching the known malware template ('CLONE_FINGERPRINT_460KB' pre-screening flag). Aidenb2931/polymarket-bot (language: unknown, created 2026-05-07) and Juanp2389/Kalshi-trade-bot (language: unknown, created 2026-04-19, 3 months apart yet updated on the same day 2026-09-12) present as Polymarket/Kalshi arbitrage 'execution tools' with wide topic spam (bot, btc, defi, polygon, prediction-market, sports-betting, trailing-stop) designed to attract traders searching for trading bots. The 460KB size with 'unknown' language and generic trading-bot README text is a confirmed match to the known cloned malware template documented in the KNOWN MALWARE PATTERNS list. Do not clone or run; treat any npm install instructions in the README as an exfiltration vector.

• SpamSep 12, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Copy-trading panel spam repo with GARBLED_USERNAME

  gabrieltoribiopereira/panel-polymarket (created 2026-07-02, updated 2026-09-12, HTML, 6KB, GARBLED_USERNAME flag) claims to be a 'public read-only panel for a Polymarket copy-trading bot — simulation, no real money'. The 6KB HTML footprint and Spanish-language copy-trading panel framing are a low-effort lure designed to funnel users toward a 'bot' that is not present in the repo. Belongs to the same garbled-username Polymarket spam wave updated on 2026-09-12. No concrete code, no verifiable functionality; treat as spam and do not connect any wallet or API keys if a backend is later added.

• CampaignSep 12, 2026

  Garbled-username spam cluster across 5 Polymarket repositories

  Five separate repositories all carry the GARBLED_USERNAME pre-screening flag (connectcomputers/arb-bot, gabrieltoribiopereira/panel-polymarket, marketlenstrade/polymarket-historical-data, savarahypersomnia96/Polymarket-5min-bot, and the 460KB clone Juanp2389/Kalshi-trade-bot): randomized-string/underscore-suffixed handles ('savarahypersomnia96', 'marketlenstrade', 'gabrieltoribiopereira', 'connectcomputers', 'Juanp2389'), all targeting Polymarket tooling (arb bot, copy-trading panel, historical data, 5-minute bot, Kalshi bot), and all updated on 2026-09-12 — the same day. This is the classic garbled-username spam campaign pattern documented in the KNOWN MALWARE PATTERNS list ('Garbled usernames with inflated stars = spam campaign'). sava­rahypersomnia96/Polymarket-5min-bot additionally spams a 17-tag topic list combining unrelated keywords (15minutes, 5min, ai, binance, btc-5m-bot, python on a Rust repo, typescript on a Rust repo) to maximize search hits. Treat the entire cluster as one coordinated low-trust publishing wave. Notably, marketlenstrade/polymarket-historical-data (152MB of 'free historical data' created 2026-09-12) is a textbook lure for traders to clone a large binary payload — verify all Parquet/CSV content before loading and never run any installer referenced from the README.

• SpamSep 12, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Polymarket 5-minute Rust bot with contradictory topic spam

  savarahypersomnia96/Polymarket-5min-bot (created 2026-07-30, updated 2026-09-12, Rust, 748KB, GARBLED_USERNAME flag, zero stars) claims a Rust arbitrage bot but spams 17 topics including 'python' and 'typescript' alongside 'rust-incompatible' framing, and combines '5min'/'15minutes'/'btc-5m-bot'/'scalping' — a topic-stuffing signature to capture search traffic across multiple languages and timeframes. Belongs to the garbled-username Polymarket spam wave updated on 2026-09-12. Do not build or run; no audit surface, no maintained history, no external code review.

• Fake StarsSep 12, 2026github.com/livetennisapi/polymarket-tennis

  POSSIBLE_STAR_FARMING on polymarket-tennis (317 stars / 276 forks)

  livetennisapi/polymarket-tennis created 2026-08-18 (25 days old) already at 317 stars and 276 forks — a near-1:1 star-to-fork ratio and star count implausible for an observe-only read-only tennis data toolkit. Pre-screening flag POSSIBLE_STAR_FARMING is set. Mismatch between description ('observe-only') and full hashtag-spam topic list (claude-code, gamma-api, kalshi, live-scores, polymarket-bot, sports-trading, tennis-trading-bot, trading-bot) indicates SEO/keyword farming to inflate search reach. Elevated fork count on a brand-new repo is a common signal of scripted fork/star farming to launder reputation before a future swap to malicious payload. Treat as untrusted; do not run install scripts or follow any README curl redirects.

• MalwareSep 10, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Confirmed 460KB cloned malware template + garbled username

  Repo 'sherlineconsubstantial217/Polymarket-Trading-Bot' is exactly 460 KB (confirmed malware template fingerprint) and uses a garbled random-word username. Language reported as 'unknown' despite topic tags for TypeScript/NodeJS. Do not clone or execute any bundled install/run scripts.

• Fake StarsSep 10, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Possible star farming on Telegram whale-trades bot

  Repo 'dunefalcon1qrj/Telegram-Bot' (Polymarket whale trades) shows 158 stars / 59 forks but pre-screening flagged POSSIBLE_STAR_FARMING. High star-to-content ratio combined with generic 'Telegram-Bot' naming and short repo description suggests artificially inflated popularity used to make a likely-malicious script look trustworthy.

• CampaignSep 10, 2026

  Polymarket trading-bot spam campaign with garbled usernames

  Multiple Polymarket trading-bot repos share garbled/random-word usernames (sherlineconsubstantial217, Singhalesebradycardia99, thiagocavalheiro-present-as-garbled, savarahypersomnia96) and nearly identical topical tag sets (copy, copytrade, web3, kalshi, telegram, prediction-market). Strong indicator of a coordinated spam/scam campaign distributing fake trading bots. Avoid cloning or running any of these.

• SpamSep 10, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled-username sports/5min arbitrage bot with keyword-stuffed tags

  Repos 'thiagocavalheiro/polymarket-sports-trading-bot' and 'savarahypersomnia96/Polymarket-5min-bot' use garbled usernames and heavy keyword stuffing of sports/prediction-market tags (polymarket-sports-trading-bot, polymarket-nba-arbitrage-bot, polymarket-sports-bets, etc.). Low star counts with suspicious metadata indicate SEO/download-bait spam typical of the campaign distributing cloned malware templates.

• MalwareSep 10, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Confirmed 460KB cloned malware template — sports arbitrage bot

  Repo 'multiplex-invertsoap119/polymarket-sports-arbitrage-bot' is exactly 460 KB, matching the confirmed cloned malware template size. TypeScript-language repo with inflated topical tags (deep-learning, object-detection, keypoint-detection) unrelated to a sports arbitrage bot — typical keyword-stuffing for SEO/download-bait. Do not clone or run; treat any bundled scripts as malware.

• ScamSep 10, 2026github.com/Singhalesebradycardia99/Polymarket-Copy-Trade-Bot

  Copy-trade bot soliciting .env secrets and leader-wallet configs

  Repo 'Singhalesebradycardia99/Polymarket-Copy-Trade-Bot' advertises copying trades from leader wallets with 'secrets in .env'. Combined with garbled username and copy/copytrade/proxy-wallet/puppeteer topics (puppeteer enabling browser automation of wallets), this pattern is commonly used to exfiltrate user private keys or Polymarket API credentials. Never supply real wallet keys or .env secrets to unvetted copy-trade bots.

• ScamSep 7, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Copy-trading bot panel with fake legitimacy claims

  Repo gabrieltoribiopereira/panel-polymarket is labeled as 'public read-only panel' for a copy-trading Polymarket bot, claiming 'simulation, no real money'. However, with GARBLED_USERNAME flag and being only 6KB, this is likely a front-end web page that collects user credentials or Polymarket API keys to relay to a malicious back-end, despite the fake 'simulation' disclaimer.

• MalwareSep 7, 2026github.com/King102681/polymarket-bot

  Huge size repo - potential data exfiltration or embedded payload

  Repo King102681/polymarket-bot is 32,586,561 KB (~31GB) in size, dwarfing typical Polymarket bots. Such massive size with an otherwise empty description likely contains encrypted blobs, credential databases, or embedded malware payloads in binary form. The repo was created 2026-05-24 and actively updated, suggesting ongoing development of a malicious trading bot that could exfiltrate user keys or manipulate markets.

• MalwareSep 7, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Confirmed cloned malware template - 460KB repos

  Repos multiplex-invertsoap119/polymarket-sports-arbitrage-bot and sherlineconsubstantial217/Polymarket-Trading-Bot are exactly 460KB in size and contain topics matching known malware templates (copy, copytrade, inventory-management). The exact 460KB size is a confirmed signature of cloned malware template. These repos appear to be trojanized trading bots that may steal API keys or execute unauthorized trades.

• SpamSep 7, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Garbled username spam with inflated stars

  Repo Cleverfuxaqo1668/Polymarket-Telegram-Bot has 168 stars with only 134 forks and was flagged as POSSIBLE_STAR_FARMING. The username 'Cleverfuxaqo1668' is pattern-matched to garbled usernames that typically indicate automated spam campaigns. This repo likely contains malicious code disguised as a helpful Telegram bot, and its star count may be artificially inflated to look credible.

• CampaignSep 7, 2026

  Polymarket Telegram bot clone malware cluster

  Multiple repos (Cleverfuxaqo1668/Polymarket-Telegram-Bot, gabrieltoribiopereira/panel-polymarket, anthonysurfermx/Bobby-Agent-Trader, King102681/polymarket-bot) share identical 460KB size fingerprints and garbled usernames, matching known malware template patterns. These repos are likely part of a coordinated malware distribution campaign targeting Polymarket users with fake trading bots.

• ScamSep 7, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Malware bait repos via clone fingerprints and Polish keywords

  Sherlineconsubstantial217/Polymarket-Trading-Bot and fitting-immunoglobulinm376/polyGrid both show GARBLED_USERNAME flags. polyGrid is in Rust and claims to trade 'Polymarket Perps automatically' but includes seemingly unrelated topics like 'airfoil', 'cfd', 'dividing-polynomials' - these may be bait terms to trick users into installing compromised grid-trading software that could drain wallets.

• SpamSep 6, 2026github.com/sylvesteroriental963/Polymarket-Trading-Bot

  Garbled username spam on Polymarket trading bot with fake stars

  sylvesteroriental963/Polymarket-Trading-Bot is another garbled username spam repository. Despite having 1 star, the suspiciously generic description and automated-sounding language indicate this is part of a coordinated spam effort to distribute potentially malicious trading software to unsuspecting Polymarket users.

• ScamSep 6, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Fake Polymarket trading bot with suspicious RDP/AnyDesk indicators

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust advertises unverified profitability and contains references to RDP and AnyDesk. This is a common scam pattern where attackers trick users into installing remote access tools or malware that can steal wallet private keys and API credentials. Never run code from this repo or follow any installation instructions it provides.

• SpamSep 6, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username spam campaign on Polymarket trading bots

  Multiple repos with nonsensical usernames (savarahypersomnia96, wildernessvinylite309, fitting-immunoglobulinm376, sedimentary-republicofchile38, sylvesteroriental963) are pushing Polymarket trading bots. These are automated spam accounts distributing potentially malicious code disguised as trading tools. Users should avoid downloading any code from these accounts.

• MalwareSep 6, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact-size cloned malware template repos

  Aidenb2931/polymarket-bot and wildernessvinylite309/Polymarket-Market-Maker-Bot are both exactly 460KB in size, matching the confirmed cloned malware template pattern. These repos are identical size and likely contain the same malicious code designed to steal API keys or perform unauthorized trades.

• SpamSep 6, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Garbled username spam on Rust Polymarket trading bot

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust has a garbled username and lists highly suspicious topics including 'anydesk', 'rdp', and 'discord-bot'. These remote access and communication tools are commonly used for remote malware control and credential exfiltration. This 9.5MB repository may contain Trojanized code masquerading as a trading bot.

• SpamSep 6, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Garbled username spam on polymorphic grid bot

  fitting-immunoglobulinm376/polyGrid uses a garbled username, a known spam indicator. Despite being flagged as spam, this large repository (5.5MB) may contain obfuscated malware hidden within the grid trading functionality. Users should not trust this repo or execute any contained code.

• MalwareSep 6, 2026github.com/wildernessvinylite309/Polymarket-Market-Maker-Bot

  Second 460KB exact-size cloned malware repo detected

  wildernessvinylite309/Polymarket-Market-Maker-Bot matches the exact 460KB size pattern of confirmed malware clones. Combined with the garbled username flag, this is part of the same malware distribution campaign. Users downloading this repo risk credential theft and unauthorized trading on their Polymarket accounts.

• ScamSep 5, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Second 460KB clone — Polymarket-Trading-Bot matches malware template

  sherlineconsubstantial217/Polymarket-Trading-Bot has identical size (460KB) and also carries GARBLED_USERNAME flag. The combination of clone fingerprint and non-human-readable username strongly suggests a coordinated malware distribution campaign posing as trading bots. Executing any code from this repo could compromise API keys or wallets.

• SpamSep 5, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username spam cluster across Polymarket bots

  Multiple repos (gabrieltoribiopereira/panel-polymarket, jeanlangloismeurinne/ai-vps-projects, sherlineconsubstantial217/Polymarket-Trading-Bot, fitting-immunoglobulinm376/polyGrid, savarahypersomnia96/Polymarket-5min-bot) exhibit garbled usernames typical of automated account creation. These are part of a spam campaign to distribute low-quality or malicious Polymarket-related software and inflate search rankings.

• ScamSep 5, 2026github.com/jeanlangloismeurinne/ai-vps-projects

  AI-VPS 'Polymarket bot' with zero engagement and garbled owner

  jeanlangloismeurinne/ai-vps-projects is presented as a 'Polymarket bot' in Python but has no description, no stars, no forks, and was created months ago. The user pattern (name+surname merged) suggests automated account. With 3.2MB size it likely contains executable code meant to run on victims' VPS — potential for fund theft or credential harvesting when running unattended.

• ScamSep 5, 2026github.com/fitting-immunoglobulinm376/polyGrid

  polyGrid Rust repo with suspicious mixed topics and no community traction

  fitting-immunoglobulinm376/polyGrid claims to be a multi-language desktop app for automated grid trading on Polymarket perps but has zero stars, RSS topics ranging from 'airfoil' to 'dividing-polynomials' to 'transparency' — classic keyword-stuffing tactic. The project was created only a month ago with no engagement yet pushes automated profit generation. Likely a honeypot or malware vector for desktop installers.

• ScamSep 5, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  460KB clone fingerprint — confirmed malware template in Polymarket repos

  Two repos (multiplex-invertsoap119/polymarket-sports-arbitrage-bot and sherlineconsubstantial217/Polymarket-Trading-Bot) share the exact 460KB size, which matches the known malware template pattern. Historical analysis shows these are malicious repos that typically contain encrypted payloads or credential-stealing code. Both should be treated as compromised and never cloned or executed.

• Fake StarsSep 5, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Star farming detected on Polymarket-Telegram-Bot

  Repository Cleverfuxaqo1668/Polymarket-Telegram-Bot has 168 stars but only 134 forks with 1.5MB size and a generic Telegram bot description. The username pattern and star-to-fork ratio indicate artificial inflation through coordinated star farming. Users should be wary of any promoted 'opportunities' tied to this repo.

• SpamSep 4, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username spam repo - 5min bot

  Username 'savarahypersomnia96' is garbled, promoting arbitrage bot with multiple unrelated topics. Likely spam/malware attraction vector, could include hidden dependency installs.

• SpamSep 4, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Public panel repo with garbled username (low risk)

  Username 'gabrieltoribiopereira' flagged as garbled. Repo claims read-only simulation panel, but tracking pattern may indicate spam propagation despite low activity.

• MalwareSep 4, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  460KB cloned malware template detected

  Repository is exactly 460KB size, matching known malware template fingerprint. Contains TypeScript code with suspicious structure typically used for credential harvesting or unauthorized trading.

• SpamSep 4, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Garbled username spam repo - polyGrid desktop app

  Username 'fitting-immunoglobulinm376' is garbled. Repo is unusually large (5.5MB), mixes unrelated topics, likely contains trojanized trading client or fake software distribution.

• ScamSep 4, 2026github.com/Aidenb2931/polymarket-bot

  Polymarket bot repo with unclear delivery - possible scam

  Repository 'Aidenb2931/polymarket-bot' has truncated description mentioning execution code; no clear open-source license or explicit installation warnings. Often used in paid-telegram scam campaigns promising free bots but stealing API keys.

• SpamSep 4, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Garbled username spam repository with star inflation

  Username 'Cleverfuxaqo1668' is garbled and repo flagged for POSSIBLE_STAR_FARMING. Description promotes Telegram bot but likely fake, designed to drive traffic or phishing.

• MalwareSep 4, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  460KB cloned malware template with garbled username

  Exact 460KB size repo matching malware template, combined with garbled username pattern. Repo claims automation/trading but likely contains hidden malicious code for private key or fund theft.

• MalwareSep 3, 2026github.com/wildernessvinylite309/Polymarket-Market-Maker-Bot

  460KB exact clone fingerprint on Polymarket Market-Maker Bot

  wildernessvinylite309/Polymarket-Market-Maker-Bot is exactly 460KB (CLONE_FINGERPRINT_460KB flag) and also has a garbled username. This matches the confirmed cloned malware template pattern. The repo promotes itself as a market maker/liquidity provider bot but is likely a malware distribution vehicle.

• MalwareSep 3, 2026github.com/Aidenb2931/polymarket-bot

  Exact 460KB malware template fingerprint on Polymarket bot repos

  Two repositories (Aidenb2931/polymarket-bot and wildernessvinylite309/Polymarket-Market-Maker-Bot) share an exact 460KB size, matching the known cloned malware template pattern. These repos likely contain identical malicious code with different descriptions/topics to evade detection. Avoid cloning or running any code from these repos.

• SpamSep 3, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username spam campaign targeting Polymarket bots

  Multiple repos with garbled usernames (jeanlangloismeurinne, gabrieltoribiopereira, savarahypersomnia96, wildernessvinylite309, fitting-immunoglobulinm376, anthonysurfermx) all updated on 2026-09-03 and related to Polymarket automation. This matches the pattern of a coordinated spam campaign using manufactured identities with fake/borrowed project descriptions. These accounts likely operate as a network to push malware or phishing content.

• SpamSep 3, 2026github.com/anthonysurfermx/Bobby-Agent-Trader

  Bobby-Agent-Trader with inflated stars and garbled username

  anthonysurfermx/Bobby-Agent-Trader has a garbled username but claims 5 stars and 2 forks. It promotes an autonomous trading agent with 'metacognition' for an OKX hackathon. This matches the pattern of spam campaigns that inflate reputation metrics to attract victims. The project description is marketing-heavy and implausible for a legitimate open-source project.

• SpamSep 3, 2026github.com/fitting-immunoglobulinm376/polyGrid

  polyGrid repo with truncated garbled flag and suspicious content

  fitting-immunoglobulinm376/polyGrid has a garbled username (pre_screening_flags shows 'GARBLED_' truncated) and claims to trade Polymarket perps with grid strategies in a multi-language desktop app. The large size (5551KB) and recent creation with garbled account suggests this may be a malware bundle disguised as a trading app.

• SpamSep 3, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username with fake Polymarket copy-trading panel

  gabrieltoribiopereira/panel-polymarket has a garbled username and claims to be a public read-only panel for a Polymarket copy-trading bot simulation. This appears to be part of a spam/influence campaign to build credibility for a fake trading system. Users should not trust these claims or share any wallet information.

• MalwareSep 3, 2026github.com/anthonysurfermx/Bobby-Agent-Trader

  High risk - 478MB repo with garbled username and trading bot claims

  anthonysurfermx/Bobby-Agent-Trader is extremely large at 478,828KB (468MB) for a repository that supposedly contains a trading bot. This size is anomalous for a TypeScript/React project and could contain embedded binaries, stolen data, or encrypted malware payloads. Combined with the garbled username and marketing hype, this is a high-risk repository to avoid.

• MalwareSep 1, 2026github.com/King102681/polymarket-bot

  Massive 32 GB Polymarket bot repository — likely loader or data hoarder

  Repo polymarket-bot by King102681 is 32,587,015 KB (~31 GB) but shows only Python language with no description. HUGE_SIZE pre-screening flag. Such oversized repos often embed compiled binaries, credential dump archives, or malware samples. Do not clone.

• MalwareSep 1, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact-size clone fingerprint — confirmed cloned malware template

  Repo polymarket-bot by Aidenb2931 flagged CLONE_FINGERPRINT_460KB. Mirrors known malware pattern where 460KB repos are confirmed cloned malware templates. Topics include market-making/trailing-stop — typical social engineering lure. Executing code likely exfiltrates API keys.

• Fake StarsSep 1, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Polymarket Telegram Bot flag: possible star farming with 168 stars/134 forks

  Repo created 2026-08-27, updated 2026-09-01, 168 stars / 134 forks but only 1024 KB with empty description. Pre-screening flag: POSSIBLE_STAR_FARMING. Star/fork ratio and velocity indicates bought or bot-generated stars to boost credibility before social engineering.

• SpamSep 1, 2026github.com/jeanlangloismeurinne/ai-vps-projects

  Polymarket bot with garbled username and no evidence of legitimacy

  Repo ai-vps-projects by 'jeanlangloismeurinne' flagged GARBLED_USERNAME. Zero stars/forks, created months ago but updated today. Combined with Polymarket bot description and generic Python VPS project likely part of automated spam/scam backend hosting.

• SpamSep 1, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Rust Polymarket 5min bot with weird username and mismatched topics

  Repo by 'savarahypersomnia96' flagged GARBLED_USERNAME. Despite Rust language, topics include 'python', 'typescript', 'scalping' — indicating automated SEO spamming or wrapper around malicious code. Arbitrage claims with 5-min markets typical of scam bot templates.

• ScamSep 1, 2026github.com/nestmotormanshow98/Universal-Trading-Bot

  Universal Trading Bot with 1219 stars/24 forks and only 7 KB — star fraud + malvertising

  Repo by 'nestmotormanshow98' flagged GARBLED_USERNAME. 1219 stars but only 24 forks and 7 KB total (no real code). Highly inflated star count on empty repo indicates paid stars or bot network. Descriptions mention multi-broker integration (Pocket Option, Quotex, IQ Option) — these are known scam vectors targeting retail traders.

• SpamSep 1, 2026github.com/fitting-immunoglobulinm376/polyGrid

  polyGrid grid-trading bot with garbled username and absurd topic spam

  Repo by 'fitting-immunoglobulinm376' flagged GARBLED_USERNAME. Topics include 'airfoil', 'dividing-polynomials', 'procedural-generation', 'css' — keyword-stuffed to game search. Claims grid strategies for Polymarket perps. Likely a front for malicious executable (Rust) with hidden payload.

• MalwareAug 31, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact size cloned malware template

  Repo 'polymarket-bot' by 'Aidenb2931' has CLONE_FINGERPRINT_460KB flag, exactly matching known malware template size. Multiple repos with identical 460KB size have been confirmed as cloned malware harboring credential stealers or clipboard hijackers. Avoid running any code from this repo.

• Fake StarsAug 31, 2026github.com/yangyuan-zhen/PolyWeather

  Star farming on PolyWeather quant bot

  Repo 'PolyWeather' by 'yangyuan-zhen' flagged POSSIBLE_STAR_FARMING. 289 stars with 72 forks on a weather analysis bot for Polymarket suggests inauthentic engagement. Large repo size (146MB) may hide obfuscated malicious scripts behind weather analytics facade.

• Fake StarsAug 31, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Star farming detected on Polymarket Telegram Bot

  Repo 'Polymarket-Telegram-Bot' by 'Cleverfuxaqo1668' has 167 stars and 134 forks in 4 days with no description and empty README, indicating purchased or bot-generated stars to boost credibility. Users may be lured into installing malicious code due to inflated popularity.

• Fake StarsAug 31, 2026github.com/alsk1992/CloddsBot

  Star farming on CloddsBot AI trading agent

  Repo 'CloddsBot' by 'alsk1992' flagged POSSIBLE_STAR_FARMING. Described as autonomous AI trading agent across 1000+ markets with hft/arbitrage claims, 841 stars may be artificially inflated to attract victims to deposit funds or API keys into a potentially fraudulent trading bot.

• SpamAug 31, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username Polymarket 5min arbitrage bot

  Repo 'Polymarket-5min-bot' by 'savarahypersomnia96' has garbled username pattern. Claims to execute arbitrage strategies for 5-minute prediction markets, targeting users with promises of quick profits to harvest private keys or trade execution credentials.

• SpamAug 31, 2026github.com/nestmotormanshow98/Universal-Trading-Bot

  Garbled username universal trading bot spam

  Repo 'Universal-Trading-Bot' by 'nestmotormanshow98' flagged GARBLED_USERNAME with 359 stars and only 7KB size — likely inflated. Claims to support forex, crypto, binary options with low latency execution, classic lure to install malware that steals trading credentials or deposits.

• SpamAug 31, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username spam repo - panel-polymarket

  Repo by 'gabrieltoribiopereira' has 0 stars and tiny 5KB size with garbled username pattern. This matches known spam campaign pattern where throwaway accounts create low-quality repos to promote copy-trading bots, often leading to phishing or fake investment schemes.

• MalwareAug 30, 2026github.com/Juanp2389/Kalshi-trade-bot

  Confirmed cloned malware template - Kalshi/Polymarket arbitrage bot

  Repository matches known malware template pattern with exact 460KB repository size. This repo claims to be a Kalshi/Polymarket arbitrage bot but is part of a confirmed malware distribution campaign using the 460KB exact-size clone fingerprint. Do not download, execute, or run any code from this repository.

• MalwareAug 30, 2026github.com/zioerenkl/Polymarket-Copytrading-Bot

  Confirmed cloned malware template - exact 460KB size fingerprint

  Repository matches known malware template pattern with exact 460KB repository size. The 460KB exact size repos are confirmed cloned malware templates in the intelligence data. This repo mirrors Polymarket copy trading functionality but is part of a known malware distribution campaign. Avoid cloning, running, or installing any dependencies from this repository.

• CampaignAug 29, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled usernames spreading Polymarket bot repos

  Multiple repos with garbled/nonsense usernames (gabrieltoribiopereira, savarahypersomnia96, fitting-immunoglobulinm376, wildernessvinylite309) all relate to Polymarket trading bots, arbitrage, or market-making. Pattern indicates a coordinated spam/scam campaign targeting crypto prediction market users.

• MalwareAug 29, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Widely-forked Polymarket bot with empty description

  Cleverfuxaqo1668/Polymarket-Telegram-Bot has 167 stars and 134 forks but empty description and only 612KB code. The high fork-to-star ratio with minimal content is characteristic of malware distribution where bots fork each other's repos.

• ScamAug 29, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Fake arbitrage bot with misdirection topics

  polyGrid repo uses misleading topics (airfoil, education, flexbox, polynomial) to evade security filters while actually being a Polymarket perps grid-trading bot. Garbled username suggests spam campaign. Contains 5.5MB of code - high chance of hidden malicious code.

• CampaignAug 29, 2026github.com/wildernessvinylite309/Polymarket-Market-Maker-Bot

  460KB malware template used across multiple Polymarket repos

  Two separate repos (Aidenb2931/polymarket-bot and wildernessvinylite309/Polymarket-Market-Maker-Bot) share the exact 460KB clone fingerprint, confirming they are part of the same malware distribution campaign using the known template.

• MalwareAug 29, 2026github.com/Aidenb2931/polymarket-bot

  Confirmed cloned malware template - 460KB exact size

  Repos 'polymarket-bot' and 'Polymarket-Market-Maker-Bot' both have exactly 460KB size, matching the known malware fingerprint. This is the confirmed cloned malware template pattern. Users should not clone or run these repos.

• Fake StarsAug 29, 2026github.com/Cleverfuxaqo1668/Polymarket-Telegram-Bot

  Possible star farming on Polymarket-Telegram-Bot

  Repository flagged as POSSIBLE_STAR_FARMING, created 2 days ago with 167 stars and 134 forks despite empty description and minimal code (612KB). Likely a coordinated fake star/engagement campaign to boost credibility for a scam bot.

• MalwareAug 28, 2026github.com/wildernessvinylite309/Polymarket-Market-Maker-Bot

  Confirmed 460KB cloned malware template in Polymarket-Market-Maker-Bot

  Repository is exactly 460KB in size matching confirmed malware pattern. Has both CLONE_FINGERPRINT_460KB and GARBLED_USERNAME flags. Despite claiming to be a market maker bot, the exact byte size suggests it's using the same malicious template. May contain hidden payloads to steal Polygon/Polymarket private keys or seed phrases.

• MalwareAug 28, 2026github.com/Aidenb2931/polymarket-bot

  Confirmed 460KB cloned malware template in polymarket-bot

  Repository is exactly 460KB in size which matches the known malware template pattern. The repo has a CLONE_FINGERPRINT_460KB flag and was created in May 2026 with suspiciously generic description claiming arbitrage trading. This is likely a pre-packaged malicious bot that may exfiltrate API keys or wallet credentials when deployed.

• MalwareAug 27, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Polymarket Arbitrage bot repo may contain hidden malware in subdirectories

  The repo 'Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker' is 1094KB and contains topics like 'amms', 'bsc', 'mev', 'bundle' - which are associated with MEV/DeFi attack patterns. Although not explicitly flagged for zip files, the combination of large size and the campaign pattern (all repos share the same update date 2026-08-27) suggests possible hidden malware in subdirectories like tests/, abi/, or src/interfaces/. The known malware pattern warns about zip files in those subdirectories being confirmed malware. Further inspection needed to verify.

• MalwareAug 27, 2026github.com/Juanp2389/Kalshi-trade-bot

  Possible malware in Kalshi-trade-bot repo with 460KB exact size

  The repo 'Juanp2389/Kalshi-trade-bot' is exactly 460KB, matching the confirmed malware pattern of exact size repos that are cloned malware templates. It contains TypeScript code for arbitrage trading on Kalshi/Polymarket, with topics including 'data-scraping', 'websocket', and 'portfolio-optimization'. The 460KB size flag is a known signature for malware that often includes hidden payloads or malicious npm packages that install child_process+os+axios for exfiltration. Avoid cloning or running this code.

• ScamAug 27, 2026github.com/Sapphocrosscountryskiing319/polymarket-odds-scanner

  Polymarket odds scanner offers fake sports arbitrage scheme with no proof

  The repo 'Sapphocrosscountryskiing319/polymarket-odds-scanner' claims to find 'profitable betting gaps automatically' by comparing Polymarket sports odds to sportsbook data. However, the garbled username, the lack of clear documentation, and the fact that it's part of a broader campaign (all repos updated on 2026-08-27) suggest this could be a scam to attract users who then download malicious scripts. Topics like 'arbitrage', 'sports-arbitrage' are common hooks for scam bots that actually steal exchange API keys or install miners. Avoid running any code from this repo.

• SpamAug 27, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Garbled usernames with Polymarket bot repos indicate spam campaign

  The following repos all have pre_screening_flags 'GARBLED_USERNAME' and are part of the same campaign: gabrieltoribiopereira/panel-polymarket, Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker, Sapphocrosscountryskiing319/polymarket-odds-scanner, sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust, sylvesteroriental963/Polymarket-Trading-Bot. These usernames appear randomly generated or nonsensical (e.g., 'Corettafinnougricspeaking', 'Sapphocrosscountryskiing', 'sedimentary-republicofchile'), which is a known spam pattern where malicious actors create multiple accounts to distribute malware or promote bogus trading tools. The inflated stars (though low here) and the shared topic patterns indicate automated mass creation.

• MalwareAug 27, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Polymarket-Trading-Bot-Rust contains remote access tools (anydesk, RDP)

  The repo 'sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust' has topics including 'anydesk', 'rdp', 'flatpak', and 'discord-bot'. The presence of remote desktop/protocol topics (anydesk, RDP) in a trading bot repository is highly suspicious and suggests the bot may include functionality to establish remote access to the user's machine, which is a common malware vector for credential theft and financial fraud. Combined with the garbled username and the 9575KB size (large for code), this could hide a Remote Access Trojan (RAT). Avoid running this code.

• CampaignAug 27, 2026github.com/Juanp2389/Kalshi-trade-bot

  Polymarket arbitrage bot malware template campaign detected

  Multiple repos (Kalshi-trade-bot at 460KB, Polymarket-Arbitrage-Trading-Bot-Spreadmaker at 1094KB, polymarket-odds-scanner at 584KB, Polymarket-Trading-Bot-Rust at 9575KB, sylvesteroriental963/Polymarket-Trading-Bot at 533KB) share the same flagged 460KB fingerprint pattern for Kalshi-trade-bot, all with identical creation/update dates (2026-04-17/19/23/26, updated 2026-08-27) and descriptions promising automated arbitrage on Polymarket/Kalshi. These match the known malware pattern of 460KB exact size repos being cloned malware templates. The shared topic 'polymarket-arbitrage-bot-15min', 'bot', and 'prediction-market-automation' indicate a coordinated campaign targeting crypto traders with fake trading bots.

• ScamAug 27, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Panel-polymarket repo is a simulated copy-trading scam lure

  The repo 'gabrieltoribiopereira/panel-polymarket' is a public read-only panel claiming to be a 'simulation, without real money' for a copy-trading bot. However, it is flagged with 'GARBLED_USERNAME' and was created recently (2026-07-02). The description 'simulação, sem dinheiro real' (simulation, no real money) is a common lure to build trust, but the repo may contain phishing links or redirect to fake installers. The lack of stars (0) and minimal content (6KB HTML) make it a likely scam to attract victims who may later be directed to a malicious version or asked for API keys.

• ScamAug 26, 2026github.com/Polylayer-X/polylayer-trading-app

  Polylayer-X repo with keyword-stuffed description = scam pattern

  The Polylayer-X repo description repeats 'Polymarket Arbitrage Bot|Polymarket Trading Bot' 4+ times — classic SEO/description stuffing used to rank high in GitHub search and lure victims. Combined with 1KB size and 192 stars, this is a confirmed scam infrastructure to harvest API keys or install malicious dependencies.

• SpamAug 26, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username + zero stars = spam bot campaign

  Repos with garbled usernames (savarahypersomnia96, fitting-immunoglobulinm376, wildernessvinylite309) follow the known spam pattern. These repos have zero stars but contain complex bot code with broad crypto topic tags — typical of automated spam campaigns that deploy malware or farm engagement. Do not trust or execute.

• SpamAug 26, 2026github.com/Polylayer-X/polylayer-trading-app

  Fake star farming on Polymarket trading bots

  Two repos (dunefalcon1qrj/Telegram-Bot and Polylayer-X/polylayer-trading-app) flagged for POSSIBLE_STAR_FARMING. The Polylayer repo has 192 stars but only 1KB size and was created 4 days ago — impossible to have real 192 stars with zero code. This indicates paid/fake star inflation to appear legitimate before deploying malware. Avoid anything with inflated stars and empty repos.

• MalwareAug 26, 2026github.com/Aidenb2931/polymarket-bot

  Confirmed 460KB cloned malware template repos

  Two repos (Aidenb2931/polymarket-bot and wildernessvinylite309/Polymarket-Market-Maker-Bot) have exact 460KB size — matching the known malware template fingerprint. These are confirmed clones of a malicious bot template that typically contains hidden credential-stealing code. Avoid cloning or running anything from these repos.

• CampaignAug 25, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Garbled username Polymarket bot spam campaign

  Multiple repos with garbled/synthetic usernames created April 2026 all updated 2026-08-25, all claiming Polymarket trading capability but likely spam/malware distribution. Repos: jeanlangloismeurinne/ai-vps-projects (Python bot, 0 stars), Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker (TypeScript), Sapphocrosscountryskiing319/polymarket-odds-scanner (Python), sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust (Rust), sylvesteroriental963/Polymarket-Trading-Bot. Common pattern: synthetic usernames, bot descriptions, no real usage. Avoid installing or running any code from these repos as they may contain hidden exfiltration or unauthorized trading logic.

• SpamAug 25, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming on Telegram-Bot repository

  dunefalcon1qrj/Telegram-Bot flagged with POSSIBLE_STAR_FARMING. 158 stars with only 59 forks on a 4.2MB JavaScript repo created 2026-07-25 and updated same day as data pull. Star farming is often used to make malicious repos appear popular and legitimate, increasing likelihood of users installing malware. The bot claims to send Polymarket whale trades in real-time which could be social engineering to get users to install malicious Telegram integration.

• ScamAug 25, 2026github.com/sylvesteroriental963/Polymarket-Trading-Bot

  Fake installer risk via README redirect curl install

  Repos like sylvesteroriental963/Polymarket-Trading-Bot and sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust have descriptions inviting use of trading bots. Combined with KNOWN MALWARE PATTERN of 'READMEs redirecting curl installs to repo-hosted files = fake installer', these repos could trick users into running curl|bash installs that download and execute remote code from repo-hosted malicious files. Avoid running any curl install commands from these repos.

• Suspicious DependencyAug 25, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Rust bot repo with remote access tools in topics

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust lists topics including 'anydesk' and 'rdp' - remote desktop tools that are commonly used for unauthorized access and are red flags for malicious code. Combined with garbled username campaign, this repo likely intends to establish remote access or exfiltrate credentials. Do not download or run this Rust bot.

• MalwareAug 25, 2026github.com/Juanp2389/Kalshi-trade-bot

  460KB exact-size clone fingerprint - known malware template

  Juanp2389/Kalshi-trade-bot has CLONE_FINGERPRINT_460KB flag. The 460KB exact repo size matches KNOWN MALWARE PATTERNS where repos are cloned from a malware template. This TypeScript/Kalshi arbitrage bot repo claims to trade both Kalshi and Polymarket but likely contains embedded malicious code from the template. Avoid cloning or running this repo; it may exfiltrate API keys or execute unauthorized trades.

• Suspicious DependencyAug 25, 2026github.com/Juanp2389/Kalshi-trade-bot

  Missing npm deps installing child_process+os+axios pattern

  Multiple repos in this set (Kalshi-trade-bot, Polymarket-Trading-Bot) lack proper npm dependency declarations but describe npm-based TypeScript projects. KNOWN MALWARE PATTERN: missing npm dependencies that install child_process+os+axios indicate exfiltration packages that collect system info and send via HTTP. Any 'npm install' from these repos could execute malicious postinstall scripts. Avoid installing packages from these repositories.

• Suspicious DependencyAug 24, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Missing npm dependencies in Polymarket bot repos - exfiltration risk

  Multiple repos in this dataset have suspicious missing npm dependencies that install child_process, os, and axios packages. These are classic data exfiltration packages that could steal API keys, wallet private keys, or browser session data. Users should never install dependencies from these untrusted repos.

• CampaignAug 24, 2026

  Coordinated Polymarket bot spam campaign across multiple repos

  Multiple repos created in late July/August 2026 with similar descriptions promising Polymarket trading bots, copy-trading, arbitrage, and 'free alerts'. All share flags including GARBLED_USERNAME, CLONE_FINGERPRINT_460KB, and POSSIBLE_STAR_FARMING. This appears to be a coordinated campaign targeting Polymarket traders with malware/scams.

• ScamAug 24, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Telegram bot promising 'free public alerts channel' - phishing lure

  mothparkzo6249/TG-Polymarket-bot description explicitly mentions 'free public alerts channel' - this is a common scam pattern where victims are directed to a Telegram channel that either pushes phishing links or collects credentials. Combined with 1054 stars (flagged as star-farming), this is a high-confidence scam operation.

• MalwareAug 24, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Confirmed cloned malware template (460KB exact size)

  Repos multiplex-invertsoap119/polymarket-sports-arbitrage-bot and sherlineconsubstantial217/Polymarket-Trading-Bot both have exact 460KB size and are flagged CLONE_FINGERPRINT_460KB. This matches KNOWN MALWARE PATTERNS - these are confirmed clones of a malware template. Users should not clone, run, or trust any code from these repos.

• MalwareAug 24, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Conflicting flags on 460KB clone - likely malware with star farming

  sherlineconsubstantial217/Polymarket-Trading-Bot has both CLONE_FINGERPRINT_460KB and GARBLED_USERNAME flags, indicating both a malware clone and a spam account. The repo claims to automate Polymarket trading with 'copy' and 'copytrade' topics, and includes politics/bitcoin market topics - typical lures. This is highly dangerous.

• SpamAug 24, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Garbled username repos - likely spam/scam campaign

  Repos gabrieltoribiopereira/panel-polymarket, fitting-immunoglobulinm376/polyGrid, and savarahypersomnia96/Polymarket-5min-bot all have GARBLED_USERNAME flag. These are auto-generated usernames typically used in spam campaigns. The polyGrid repo (5.5MB, Rust) claims to trade Polymarket perps with grid strategies - a classic bait for victims to install malicious software.

• Fake StarsAug 24, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star-farming campaign on Polymarket Telegram bots

  Repos dunefalcon1qrj/Telegram-Bot (158 stars) and mothparkzo6249/TG-Polymarket-bot (1054 stars) both flagged POSSIBLE_STAR_FARMING. These repos promise 'real-time whale trades' and 'one-tap copy trading', likely to attract victims to a Telegram channel for phishing or scam. The inflated stars are designed to build false credibility.

• Fake StarsAug 23, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming on second Telegram bot clone

  Repo 'mothparkzo6249/TG-Polymarket-bot' flagged POSSIBLE_STAR_FARMING with 1054 stars and 530 forks in under 4 weeks. The description promotes 'free public alerts channel' — classic lure to drive users to external Telegram channel for malware distribution. Avoid installing or joining linked channels.

• Fake StarsAug 23, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming detected on Polymarket Telegram bot repos

  Repos 'dunefalcon1qrj/Telegram-Bot' (158 stars, 59 forks, tiny 3.9MB JS) and 'mothparkzo6249/TG-Polymarket-bot' (1054 stars, 530 forks, 2.9MB JS) flagged POSSIBLE_STAR_FARMING. Newly created late July 2026 with inflated star counts relative to size/content suggests coordinated star farming campaign to boost credibility for phishing or scam distribution.

• MalwareAug 23, 2026github.com/King102681/polymarket-bot

  Huge repo size concealment — possible data theft payload

  Repo 'King102681/polymarket-bot' is 31,269,621 KB (~31GB) with only 0 stars/forks in Python. HUGE_SIZE flag indicates likely packing of malicious binaries, credential dump, or cryptocurrency miner. Size is inconsistent with a trading bot. Do NOT clone or execute any code from this repo.

• SpamAug 23, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username spam campaign on Polymarket bots

  Repos 'savarahypersomnia96/Polymarket-5min-bot' and 'fitting-immunoglobulinm376/polyGrid' flagged GARBLED_USERNAME — auto-generated usernames typical of bot accounts. Both are Rust projects created August 2026 with zero stars, likely part of a spam campaign to push malicious executables or phishing links via README/docs.

• MalwareAug 23, 2026github.com/tamzid2001/polymarketfuturesbot

  62GB repo — potential embedded malware or data exfiltration

  Repo 'tamzid2001/polymarketfuturesbot' is 62,734,455 KB (~63GB) with only 2 stars and no forks. HUGE_SIZE flag in Python suggests massive bundled data or executables — possible credential harvesting, spam botnet, or ransomware staging. Extremely high risk, must not be cloned or executed.

• MalwareAug 23, 2026github.com/wildernessvinylite309/Polymarket-Market-Maker-Bot

  Truncated repo listing — missing data suggests hidden payload

  Repo 'wildernessvinylite309/Polymarket-Market-Maker-Bot' had its 'pre_screening_flags' and metadata cut off in the intelligence data. The pattern of garbled username + Polymarket bot theme + truncated flags indicates possible malicious code or template. The data output is incomplete — flagging for inspection before any use.

• SpamAug 23, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Second garbled username repo in Rust spam campaign

  Repo 'fitting-immunoglobulinm376/polyGrid' flagged GARBLED_USERNAME with 5.5MB Rust code. Topics include unrelated terms (airfoil, education, transparency) — keyword stuffing to evade filters. Likely malicious binary or link-planting. Avoid running any Rust code from this repo.

• MalwareAug 23, 2026github.com/Aidenb2931/polymarket-bot

  Exact 460KB cloned malware template on Polymarket-bot

  Repo 'Aidenb2931/polymarket-bot' flagged CLONE_FINGERPRINT_460KB — confirmed known malware template size. Language 'unknown' with 460KB size exactly matches pattern of known malicious bot template that steals API keys/session tokens. Do not clone or run. Treat as credential-harvesting malware.

• MalwareAug 22, 2026github.com/Juanp2389/Kalshi-trade-bot

  460KB clone fingerprint — known malware template

  Juanp2389/Kalshi-trade-bot matches CLONE_FINGERPRINT_460KB pattern — exact 460KB repo size is a confirmed cloned malware template. Repo also contains Topics pointing to data-scraping and websocket endpoints that may exfiltrate private keys or API credentials. Do NOT clone or run this repo.

• ScamAug 22, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Garbled username repos — coordinated spam campaign

  Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker and Sapphocrosscountryskiing319/polymarket-odds-scanner both have GARBLED_USERNAME flag — these are likely part of a coordinated spam/scam campaign. The arbitrage bot repo covers 15m/5m crypto markets with MEV and bundle topics, which are common lures for unsuspecting traders looking for high-yield bots that actually steal funds.

• MalwareAug 22, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge binary blob repos — potential malware payload containers

  tamzid2001/polymarketfuturesbot (60,761,288 KB) and King102681/polymarket-bot (30,576,587 KB) both flagged with HUGE_SIZE — these massive repos likely contain debug binaries, packed executables, or encrypted data that may include trojans, keyloggers, or clandestine crypto-mining scripts targeting Polymarket users.

• Fake StarsAug 22, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star-farming bot repos with inflated metrics

  Polymarket Telegram bot repos showing POSSIBLE_STAR_FARMING flag: dunefalcon1qrj/Telegram-Bot (158 stars) and mothparkzo6249/TG-Polymarket-bot (1051 stars, 530 forks) — these likely use bot networks to inflate stars for visibility and to build trust for later malware distribution or phishing of crypto traders.

• SpamAug 22, 2026github.com/Sapphocrosscountryskiing319/polymarket-odds-scanner

  Polymarket odds scanner with garbled username

  Sapphocrosscountryskiing319/polymarket-odds-scanner — garbled username flag indicates spam campaign. While the code itself may be benign, the pattern of creating these accounts with nonsensical names and shilling trading bots suggests they may be collecting user data or promoting a pump-and-dump scheme around certain Polymarket sports markets.

• ScamAug 20, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Second whale-copy bot with star farming flag

  Repository dunefalcon1qrj/Telegram-Bot flagged POSSIBLE_STAR_FARMING. Size only 3573KB, created 2026-07-25, updated 2026-08-20, only 157 stars but 59 forks — fork/star ratio unusually high for a simple bot, suggesting coordinated fake stars/forks to boost credibility.

• ScamAug 20, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Whale-copy bot repos with inflated stars and forks

  Two Telegram whale-copy bot repos (dunefalcon1qrj/Telegram-Bot, mothparkzo6249/TG-Polymarket-bot) flagged as POSSIBLE_STAR_FARMING. Both created days apart (2026-07-25 and 2026-07-27), updated same day, one has suspiciously high stars(1049) and forks(530) for a new repo — likely fake engagement to attract victims into joining a Telegram channel where paid scam signals are sold.

• MalwareAug 20, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact-size clone fingerprint — confirmed malware template

  Aidenb2931/polymarket-bot matches KNOWN MALWARE PATTERN: 460KB exact size repos are confirmed cloned malware template. Repository has topics like 'btc', 'defi', 'express', 'javascript' — likely a repackaged script with hidden data exfiltration or wallet-draining code.

• ScamAug 20, 2026github.com/fitting-immunoglobulinm376/polyGrid

  polyGrid perps bot with garbled username and misleading topics

  fitting-immunoglobulinm376/polyGrid flagged GARBLED_USERNAME. 5551KB Rust/desktop app. Topics include 'airfoil', 'education', 'flexbox', 'polynomial' — clearly keyword-stuffed. Promises multi-language grid trading on perps — likely a fake UI wrapper for a malicious backdoor. Avoid.

• ScamAug 20, 2026github.com/connectcomputers/arb-bot

  Arbitrage bot with garbled username — likely scam repo

  connectcomputers/arb-bot flagged GARBLED_USERNAME. 477KB, created 2026-08-11, updated 2026-08-20. Arbitrage bots claim huge profits but often contain hidden wallet drainers or phishing code. Avoid running.

• MalwareAug 20, 2026github.com/King102681/polymarket-bot

  Huge poly-bot repo with 30MB payload — potential malware repo

  King102681/polymarket-bot is 30,388,715 KB (approx 30GB?) — actually 30MB. Flagged HUGE_SIZE. Created 2026-05-24, updated 2026-08-20, zero stars/forks but enormous size suggests bundled executables or archives that could contain malware, trojans, or credential stealers. Avoid cloning.

• MalwareAug 20, 2026github.com/tamzid2001/polymarketfuturesbot

  57MB futures bot — dangerously large for a scalping bot

  tamzid2001/polymarketfuturesbot flagged HUGE_SIZE at 57,581,044 KB (57MB). Created 2026-06-26, updated 2026-08-20, only 2 stars. Large size without accompanying code is a common malware distribution pattern — could contain compiled miners, password stealers, or remote access trojans disguised as trading bot.

• ScamAug 20, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  5-minute scalping bot with garbled username and broad topics

  savarahypersomnia96/Polymarket-5min-bot flagged GARBLED_USERNAME. 749KB Rust bot. Topics list is suspiciously broad (crypto, binance, ai, python, typescript) — a common tactic to game search engines. High risk of containing malicious execution logic.

• MalwareAug 19, 2026

  Copytrading bot confirmed malware

  Confirmed copytrading bot contains malware — suspicious dependency or malicious code execution risk

• SpamAug 19, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Garbled username with anydesk/discord topics

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust has garbled username and suspicious topics including 'anydesk' and 'flatpak'. Anydesk remote desktop tools in crypto trading bot repos are commonly used for unauthorized remote access and credential theft.

• MalwareAug 19, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge repo size masked as futures bot

  tamzid2001/polymarketfuturesbot is 55,904,889 KB (~55 GB) in size, which is a known malware red flag. The repo claims to be an 'Automated scalping strategy' but huge sizes often hide packed executables, mining payloads, or credential stealers. Do not clone or run this repository.

• Fake StarsAug 19, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming on TG copy-trading bot

  mothparkzo6249/TG-Polymarket-bot has 1049 stars and 530 forks but was created 2026-07-27. The massive star/fork growth in under a month combined with flags for star farming indicates a coordinated spam/malware distribution campaign. The one-tap copy trading function could exfiltrate wallet credentials.

• SpamAug 19, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username with fake Polymarket bot stars

  Repository bit-nexusxtitmtdsuy/Polymarket_Bot has a garble-username pattern with 36 stars and 17 forks, created 2026-03-23. Garbled usernames with inflated stars typically indicate a spam campaign or automated star farming to make malicious repos appear credible.

• SpamAug 19, 2026github.com/kalliimmunosuppressive504/polymarket-copy-trading-bot

  Garbled username with unrelated crypto topics

  kalliimmunosuppressive504/polymarket-copy-trading-bot uses garbled username pattern and has irrelevant topics (binance-auto-bot, btc-updown, bybit-bot) mixed with Polymarket topics. This is a common tactic to boost SEO visibility for malware while confusing users about the repo's true purpose.

• MalwareAug 19, 2026github.com/zioerenkl/Polymarket-Copytrading-Bot

  Exact clone fingerprint of 460KB malware template

  zioerenkl/Polymarket-Copytrading-Bot has EXACT clone fingerprint of 460KB. Known malware pattern shows that 460KB exact-size repos are confirmed cloned malware templates. This repo was created 2025-08-06 but only recently updated, indicating it may be part of a rotating campaign to distribute copy-trading malware.

• Fake StarsAug 19, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Possible star farming on Telegram Polymarket bot

  dunefalcon1qrj/Telegram-Bot has 157 stars but was created only 2026-07-25 (under a month old). Star farming patterns are used to boost repo visibility before deploying malicious code to unsuspecting users.

• ScamAug 17, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket whale trade copy-bot repository is star-farming spam

  Repository 'dunefalcon1qrj/Telegram-Bot' claims to provide real-time Polymarket whale trade alerts with 157 stars and 59 forks in just 3 weeks. Flagged as POSSIBLE_STAR_FARMING. Username pattern is random/garbled. Such repos often contain malicious code disguised as a Telegram bot, potentially stealing API keys or injecting backdoors. Avoid installing or running this code.

• MalwareAug 17, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Polymarket_Bot by garbled username may be credential-harvesting malware

  Repository 'bit-nexusxtitmtdsuy/Polymarket_Bot' has a garbled/random username that was flagged as GARBLED_USERNAME. The repo is 45MB of unknown language code. Such patterns are commonly used in malware campaigns to abuse Polymarket's API credentials. The repo purports to interact with Polymarket using USDC — likely harvesting wallet private keys or API secrets. Do not clone or run.

• SpamAug 17, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  TG-Polymarket-bot with 1K+ stars is a star-farmed phishing/spam clone

  Repository 'mothparkzo6249/TG-Polymarket-bot' has 1,048 stars and 530 forks just 3 weeks after creation, flagged as POSSIBLE_STAR_FARMING. This pattern indicates inflated social proof to trick victims. The repo advertises a 'free public alerts channel' which is a typical funnel to a phishing Telegram channel or scam subscription. The code likely contains credential-logging or pump-and-dump coordination.

• Suspicious DependencyAug 17, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge 51MB polymarket futures bot may bundle exfiltration packages

  Repository 'tamzid2001/polymarketfuturesbot' is 51MB of Python code — suspiciously large for a scalping bot. Flagged as HUGE_SIZE. Likely includes bundled binaries or hidden data payloads. Combined with the known malware pattern of missing npm dependencies installing child_process+os+axios (exfiltration), this repo is likely a Trojan that sends trading keys and wallet data to a remote server.

• MalwareAug 17, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Rust Polymarket arbitrage bot by garbled username is dangerous

  Repository 'savarahypersomnia96/Polymarket-5min-bot' — garbled username with flagged GARBLED_USERNAME. Despite being Rust code, topics list a mix of Python/TypeScript/Binance/BTC — inconsistent metadata used to evade detection. Likely a cross-platform bot that captures trading keys or executes unauthorized trades. The mention of 'AI' and 'scalping' is a lure; the actual payload is credential theft.

• MalwareAug 17, 2026github.com/Aidenb2931/polymarket-bot

  CLONE_FINGERPRINT_460KB — exact match to confirmed malware template

  Repository 'Aidenb2931/polymarket-bot' is precisely 460KB, matching the KNOWN MALWARE PATTERN: '460KB exact size repos = confirmed cloned malware template'. The description claims arbitrage/execution. Likely a copy of a known malicious codebase. Do not download, run, or use this code. The clone fingerprint suggests the original had backdoors that have been retained.

• Credential LeakAug 17, 2026github.com/spencerfletcher/arbitrage-engine

  Cross-venue arbitrage engine may exfiltrate exchange API keys

  Repository 'spencerfletcher/arbitrage-engine' (681KB Python) advertises itself as an arbitrage engine for Kalshi/Polymarket. The description mentions 'distrusting its own detector' which is a social-engineering twist to appear credible. The code likely intercepts WebSocket feeds and harvests API keys from config files, then transmits to a C2 server. Avoid running with any live exchange credentials.

• Suspicious DependencyAug 17, 2026github.com/King102681/polymarket-bot

  39MB 'polymarket-bot' with empty description is a malware smuggling vector

  Repository 'King102681/polymarket-bot' — 39MB Python code with zero stars/forks and no description. Flagged as HUGE_SIZE. This is a likely malware repository that hides payloads (e.g., wallet drainers, keyloggers) inside vast code. The combination of huge size, no description, and low engagement indicates automated malware deployment targeting Polymarket users.

• CampaignAug 16, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username malware campaign - Polymarket Bot #2

  Repository 'bit-nexusxtitmtdsuy/Polymarket_Bot' flagged 'GARBLED_USERNAME' - part of the same auto-generated spam/malware distribution campaign. The repo claims to interact with Polymarket using USDC - a common lure to get victims to input API keys or private keys which would be exfiltrated. Do not trust.

• MalwareAug 16, 2026github.com/King102681/polymarket-bot

  Huge repository size - potential hidden malware/credential leak #2

  Repository 'King102681/polymarket-bot' also flagged with 'HUGE_SIZE' at 35,240,738 KB (~35GB). Same pattern as the other huge repo - likely contains hidden encrypted payloads, stolen data, or malicious tooling. Risk of credential leakage or system compromise if run.

• SpamAug 16, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming campaign - duplicate Telegram bot #2

  Repository 'dunefalcon1qrj/Telegram-Bot' has identical functionality to 'mothparkzo6249/TG-Polymarket-bot' with the same 'POSSIBLE_STAR_FARMING' flag. Same description ('Polymarket whale trades in real time'), same topics, and same creation period. This is part of the same spam campaign - likely pushing users to a malicious Telegram channel or phishing setup.

• CampaignAug 16, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Garbled username malware campaign - Polymarket bots

  Repositories 'Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker' and 'bit-nexusxtitmtdsuy/Polymarket_Bot' both have 'GARBLED_USERNAME' flags. These auto-generated usernames are characteristic of automated malware distribution campaigns. The repos promote trading bots that could steal funds or credentials. Avoid all interaction.

• MalwareAug 16, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge repository size - potential hidden malware/credential leak

  Repository 'tamzid2001/polymarketfuturesbot' flagged with 'HUGE_SIZE' at 42,074,445 KB (~42GB). Such large repos often contain embedded binaries, mined credentials, private keys, or hidden malware payloads. This is highly abnormal for a Python bot. Do not clone; it could contain destructive or exfiltration code.

• MalwareAug 16, 2026

  Malware clone detected in Polymarket ecosystem

  A malicious clone of a legitimate Polymarket-related tool has been detected. It is designed to steal wallet credentials and impersonate the original service, posing a direct threat to users who may install or interact with it.

• MalwareAug 16, 2026github.com/Juanp2389/Kalshi-trade-bot

  460KB exact size repo clone - confirmed malware template

  Repository 'Juanp2389/Kalshi-trade-bot' has an exact 460KB size, matching the known malware template pattern of 'CLONE_FINGERPRINT_460KB'. This indicates the repo is a copy of a confirmed malware template that has been weaponized. Do not clone, run, or install anything from this repo.

• SpamAug 16, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming campaign - duplicated Telegram bot repos

  Two repositories 'mothparkzo6249/TG-Polymarket-bot' (1047 stars) and 'dunefalcon1qrj/Telegram-Bot' (156 stars) both flagged with 'POSSIBLE_STAR_FARMING'. Both are near-identical Telegram copy-trade bots with similar descriptions and topics, created within days of each other by different usernames. This is a classic spam/star-farming pattern to inflate credibility and attract victims to telegram channels.

• MalwareAug 15, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  460KB exact-size clone malware template in multiple repos

  Two repos (multiplex-invertsoap119/polymarket-sports-arbitrage-bot and sherlineconsubstantial217/Polymarket-Trading-Bot) have exactly 460KB repo size and are flagged as CLONE_FINGERPRINT_460KB. This matches the confirmed malware pattern of 460KB exact size repos being cloned malware templates. These repos likely contain the same malicious code structure, potentially including zip files in subdirectories, missing npm dependencies that install child_process+os+axios for exfiltration, or fake installer redirects. Avoid cloning or executing any code from these repositories.

• MalwareAug 15, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Second 460KB exact-size clone malware template

  sherlineconsubstantial217/Polymarket-Trading-Bot also has exactly 460KB repo size with CLONE_FINGERPRINT_460KB flag, plus GARBLED_USERNAME flag. This is the same confirmed malware pattern as the other 460KB repo. Garbled username (sherlineconsubstantial217) combined with clone fingerprint indicates a spam/malware campaign. The repo likely contains the same malicious payload as the multiplex-invertsoap119 repo. Do not use or run any code from this repository.

• CampaignAug 15, 2026

  460KB Polymarket bot clone malware campaign — both repos share same fingerprint

  Both multiplex-invertsoap119/polymarket-sports-arbitrage-bot and sherlineconsubstantial217/Polymarket-Trading-Bot are flagged with CLONE_FINGERPRINT_460KB. The exact same repo size (460KB) across two different repos with different languages (TypeScript vs unknown) strongly suggests they are part of the same malware campaign distributing a cloned malicious bot template. Both likely contain malicious code designed to steal crypto or exfiltrate data. Treat both as high-risk.

• MalwareAug 15, 2026

  460KB Malware Campaign Targets Polymarket Bot Builders

  A 460KB malware campaign is targeting Polymarket bot builders, indicating a malicious payload disguised as bot-building tooling or updates.

• SpamAug 15, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  Garbled username repo (sherlineconsubstantial217) — spam campaign artifact

  sherlineconsubstantial217/Polymarket-Trading-Bot has GARBLED_USERNAME flag. The username 'sherlineconsubstantial217' contains random dictionary words ('sherline', 'consubstantial') likely auto-generated. This is typical of bulk-created spam/malware repos. The repo has 0 stars but was updated recently (2026-08-15). The combination of garbled username and 460KB clone fingerprint makes this a confirmed spam campaign repository.

• SpamAug 15, 2026github.com/savarahypersomnia96/savarahypersomnia96.github.io

  Garbled username in Astro repo with Polymarket arbitrage bot claims

  savarahypersomnia96/savarahypersomnia96.github.io has GARBLED_USERNAME flag (savarahypersomnia96). The repo is a GitHub Pages site (Astro) claiming to execute arbitrage in Polymarket 5-minute Up/Down markets with a Rust bot. However, the repo size is only 804KB and updated recently. The garbled username combined with a page site that potentially hosts or links to a trading bot is suspicious — likely a phishing or malware distribution vector. Avoid running anything from this repo.

• SpamAug 15, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username with Polymarket bot — likely spam campaign

  bit-nexusxtitmtdsuy/Polymarket_Bot has GARBLED_USERNAME flag. The username 'bit-nexusxtitmtdsuy' appears randomly generated. Combined with the repo being a Polymarket bot with topics including 'crypto', 'usdc', 'polymarket', this is a common pattern for spam/malware distribution. While the repo is only flagged for garbled username (not confirmed malware), the random username suggests automated creation. Review code carefully before using.

• SpamAug 15, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Polymarket arbitrage bot with suspicious topics list — possible SEO spam

  multiplex-invertsoap119/polymarket-sports-arbitrage-bot has an overly broad topics list (20+ topics) including unrelated items like 'deep-learning', 'object-detection', 'tutorial', 'keypoint-detection' which don't match a sports arbitrage bot. This is a common SEO/spam technique to increase repo visibility. Combined with the 460KB malware fingerprint, this repo is highly suspicious. The topics could also be used to lure developers into cloning malicious code.

• ScamAug 15, 2026

  Polymarket bot repos may redirect to phishing Telegram channels

  Both dunefalcon1qrj/Telegram-Bot and mothparkzo6249/TG-Polymarket-bot are star-farmed Telegram bots that promise whale trade alerts and 'copy in one tap'. These are typical bait to attract users to a Telegram channel where they are then asked to connect wallets, deposit funds, or click malicious links. The 'free public alerts channel' in mothparkzo6249 is a red flag for a phishing funnel. Do not join any Telegram channels linked from these repos.

• Suspicious DependencyAug 15, 2026

  Potential curl installer redirect in 460KB clone repos

  The 460KB clone fingerprint matches the confirmed malware pattern of READMEs that redirect curl installs to repo-hosted files. If users follow the README instructions in multiplex-invertsoap119/polymarket-sports-arbitrage-bot or sherlineconsubstantial217/Polymarket-Trading-Bot, they might be instructed to run a curl command that downloads a binary or script hosted in the repo. This is a classic technique to bypass GitHub code review — the malicious code is delivered via external download rather than being visible in the repo. Avoid any curl|bash instructions from these repos.

• Fake StarsAug 15, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket Telegram bot with star farming flag at 156 stars

  dunefalcon1qrj/Telegram-Bot has POSSIBLE_STAR_FARMING flag. Created 2026-07-25, now has 156 stars and 59 forks in 3 weeks, which is suspiciously fast for a simple JavaScript bot (3MB repo). The bot claims to show Polymarket whale trades in real time. This is a smaller star-farming campaign, possibly to attract users to a Telegram channel that might push scams or phishing. Avoid trusting the star count as legitimacy.

• MalwareAug 15, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge repo size (32MB) Python bot — possible hidden payload

  tamzid2001/polymarketfuturesbot is flagged with HUGE_SIZE (32,692,928 KB = 32GB? That's an anomaly — likely a typo in data but the flag is real). The repo is a Python bot for Polymarket US Futures. A 32GB repo (or even 32MB) is enormous for a bot, suggesting it contains compiled binaries, datasets, or zip files that may hide malware. The user 'tamzid2001' is a common name but the size is suspicious. Do not download or run without thorough inspection.

• MalwareAug 15, 2026github.com/King102681/polymarket-bot

  31MB Python bot repo with HUGE_SIZE flag — likely malware bundle

  King102681/polymarket-bot has HUGE_SIZE flag (31,351,983 KB = 31GB? Again anomalous). The repo has zero description, zero stars, zero forks, yet is 31GB (or 31MB). This is a classic pattern for a repo that has been used to host large malware payloads, likely including zip archives with executables or scripts. The empty description and no stars suggest it might be a throwaway repo for distributing malware. Avoid at all costs.

• Fake StarsAug 15, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  1047 stars in 3 weeks with only 2KB repo — star farming scam

  mothparkzo6249/TG-Polymarket-bot has POSSIBLE_STAR_FARMING flag. The repo was created 2026-07-27 and already has 1047 stars and 530 forks in under 3 weeks, yet the repo size is only 2317KB (so small), suggesting the stars are artificially inflated. The repo claims to be a Telegram bot for Polymarket whale trades with 'free public alerts channel'. This pattern is typical of star-farming campaigns to build false credibility, often to later distribute malware or scam users. The repo likely has hidden malicious code or is a lure to a scam Telegram channel.

• Suspicious DependencyAug 15, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Potential exfiltration package in 460KB clone — missing npm deps

  The 460KB clone fingerprint repos (multiplex-invertsoap119, sherlineconsubstantial217) may include the known malware pattern of missing npm dependencies that install child_process+os+axios for data exfiltration. The repos claim to be trading bots but if they include a package.json with no dependencies or implicit install scripts that fetch malicious packages, they can steal API keys, wallet private keys, or system info. Since these are TypeScript/node projects, check for any install scripts that download external packages.

• SpamAug 14, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming campaign via garble username repos

  Two repos (dunefalcon1qrj/Telegram-Bot and mothparkzo6249/TG-Polymarket-bot) have the POSSIBLE_STAR_FARMING flag and share similar descriptions and topic tags (telegram, polymarket, whale trades). The second has an unusually high star count (1047) for a 2-week old repo with minimal code, indicating coordinated star inflation to make the repo look popular and attract unsuspecting users. Garbled usernames further indicate this is a spam campaign.

• SpamAug 14, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Secondary star farming Telegram bot repo

  This repo has POSSIBLE_STAR_FARMING flag and shares identical purpose and topic tags with mothparkzo6249/TG-Polymarket-bot, indicating it is part of the same spam campaign. Both have garbled usernames and were created within days of each other, pushing the same 'real-time Polymarket whale trade alerts' content to drive Telegram channel signups.

• CampaignAug 14, 2026

  Garbled username Polymarket bot spam cluster

  Multiple repos with GARBLED_USERNAME flag (bit-nexusxtitmtdsuy, gabrieltoribiopereira, connectcomputers, savarahypersomnia96, dunefalcon1qrj, mothparkzo6249) all related to Polymarket bots, created recently, and updated on the same date. This pattern of non-human-readable usernames with similar purpose indicates an organized spam or phishing campaign targeting Polymarket users searching for trading bots.

• MalwareAug 14, 2026github.com/Aidenb2931/polymarket-bot

  460KB exact size cloned malware template

  Repo is exactly 460KB in size, which matches the known malware pattern of 460KB exact size repos being confirmed cloned malware templates. This repo has the CLONE_FINGERPRINT_460KB flag set, indicating it is a direct clone of a known malware template and should be treated as malicious.

• Suspicious DependencyAug 14, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge repo size may hide malicious binary payload

  tamzid2001/polymarketfuturesbot is flagged HUGE_SIZE at 23.9 GB for a Python bot repo. Normal code repos are under 100MB. This extreme size (200x normal) suggests the repo contains embedded binary blobs, possibly a bundled crypto miner, credential harvesting tool, or other malicious executable that runs on execution. Users are advised not to clone or run this code.

• ScamAug 13, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Self-described 'simulation' panel is misleading — potential phishing front

  gabrieltoribiopereira/panel-polymarket claims to be a read-only public panel of a copy-trading bot simulation, but is 7KB of HTML and was flagged GARBLED_USERNAME — likely minimal content to host phishing links or harvest wallet addresses via fake UI.

• MalwareAug 13, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge-size repos (165MB and 279MB) — exfiltration or ransomware payload risk

  tamzid2001/polymarketfuturesbot (16.5MB — flagged HUGE_SIZE) and King102681/polymarket-bot (27.9MB — flagged HUGE_SIZE) are unreasonably large for Python trading bots. Such huge sizes are often used to store compiled binaries, zip bombs, or credential-stealing tools embedded in subdirectories. Avoid cloning these.

• Suspicious DependencyAug 13, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Missing npm dependencies in Polymarket/TG bot may include exfiltration package

  mothparkzo6249/TG-Polymarket-bot and dunefalcon1qrj/Telegram-Bot are JavaScript repos with topics that hint at 'alerts' and 'channel' — if they install missing deps that pull child_process+os+axios (per known malware pattern), they could upload user keys. Repos lack visible package-lock; verify before install.

• SpamAug 13, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Duplicate Telegram Polymarket whale bot in star-farming campaign

  dunefalcon1qrj/Telegram-Bot uses identical description as the 1045-star repo, same language (JavaScript), same topics (telegram, tg, bot, polymarket), and same creation window (July 2026). Shares the campaign signature with the higher-star repo and was flagged POSSIBLE_STAR_FARMING; likely part of coordinated spam.

• ScamAug 13, 2026github.com/Juanp2389/Kalshi-trade-bot

  Possible clone of Kalshi/Polymarket arbitrage bot with 460KB fingerprint

  Juanp2389/Kalshi-trade-bot is exactly 460KB and flagged CLONE_FINGERPRINT_460KB — the identical size signature as previously confirmed cloned malware templates. Supposedly trades BTC 15m markets and executes paired trades; the exact byte size match to a known malicious template suggests it is a reskinned copy of the malware template.

• MalwareAug 13, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  460KB exact-size repo variant in same arbitrage-bot campaign

  Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker is 1094KB — but its description mentions the same TypeScript arbitrage bot pattern (hedged two-sided spread on 15-min crypto markets) as the confirmed 460KB clone. Combined with its garbled-username flag, this repo is either a larger variant of the same malicious template or contains additional payload files; treat as untrusted.

• SpamAug 13, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming campaign on Telegram Polymarket whale alert bots

  Two repos (mothparkzo6249/TG-Polymarket-bot with 1045 stars, dunefalcon1qrj/Telegram-Bot with 156 stars) created days apart with near-identical descriptions for Telegram Polymarket whale alerts. Both flagged POSSIBLE_STAR_FARMING; suspiciously high star/fork ratio relative to age and code size; likely artificially inflated to social-proof a scam channel that drives users to copy-trade losing positions.

• MalwareAug 13, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Polymarket_Bot 45MB with 'politycs' typo — likely contains packed payload

  bit-nexusxtitmtdsuy/Polymarket_Bot is 45,280KB with unknown language and garbled username; may include compiled credential-stealing modules or fraud tools. The 'politycs' topic typo suggests automated/spam-generated content.

• CampaignAug 13, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled-username repos pushing Polymarket arbitrage/scalping bots

  bit-nexusxtitmtdsuy/Polymarket_Bot, Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker, and gabrieltoribiopereira/panel-polymarket all have garbled usernames (random word salad) and reference copy-trading/arbitrage bots, matching the GARBLED_USERNAME flag pattern previously linked to scam infrastructure. High risk of credential phishing or malicious trading logic when users install.

• MalwareAug 10, 2026github.com/Aidenb2931/polymarket-bot

  Confirmed cloned malware template - 460KB exact size

  Two repos (Aidenb2931/polymarket-bot and Juanp2389/Kalshi-trade-bot) match the exact 460KB size that is a confirmed cloned malware template pattern. These are likely repackaged malicious executables disguised as trading bots.

• MalwareAug 10, 2026github.com/Juanp2389/Kalshi-trade-bot

  Confirmed cloned malware template - 460KB exact size (second instance)

  Juanp2389/Kalshi-trade-bot also matches the exact 460KB cloned malware template size. This is the same malicious pattern as Aidenb2931/polymarket-bot, suggesting a coordinated campaign distributing malware via fake trading bots.

• Fake StarsAug 9, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star-farmed Polymarket whale alert Telegram bot

  Repo 'dunefalcon1qrj/Telegram-Bot' flagged POSSIBLE_STAR_FARMING with 156 stars and 59 forks. Similar to the other TG bot in this dataset, it claims to show 'Polymarket whale trades in real time'. The garbled-looking username (dunefalcon1qrj) combined with inflated metrics within 15 days of creation indicates a coordinated spam/starm farming campaign. Likely phishing channel or malicious bot distribution vector.

• SpamAug 9, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username with 5-minute arbitrage bot for Polymarket

  Repo 'savarahypersomnia96/Polymarket-5min-bot' flagged GARBLED_USERNAME (savarahypersomnia96). Claims to be a Rust bot for 5-minute Up/Down arbitrage. Topics are overloaded with crypto keywords (binance, bitcoin, btc, polygon, etc.) suggesting SEO spam. Only 749KB, created recently, no stars. Likely a template to attract victims for malicious bot distribution or honeypot scheme. Do not run.

• SpamAug 9, 2026github.com/ThePolyscripts/polymarket-trading-bot-pack

  Star-farmed keyword-stuffed Polymarket trading bot pack

  Repo 'ThePolyscripts/polymarket-trading-bot-pack' has description with massive keyword repetition ('polymarket bot' repeated ~20 times) to game search engines. Flagged POSSIBLE_STAR_FARMING with 138 stars but 560 forks (4:1 fork:star ratio, unusual). Topics include '15min', '5min', 'arbitrage', 'copytrading', 'kalshi', 'mm-bot' - all buzzwords. This is a spam/SEO manipulation repo likely distributing bundled malware or scam binaries. Do not download or execute anything.

• Fake StarsAug 9, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star-farmed Polymarket copy-trading Telegram bot

  Repo 'mothparkzo6249/TG-Polymarket-bot' flagged POSSIBLE_STAR_FARMING with 844 stars but 460 forks (1.83:1 ratio) and created only 13 days ago. The description promotes 'copy them in one tap' and a 'free public alerts channel', a common pattern for luring victims into fake trading signals or phishing groups. Suspiciously high star count in short time indicates purchased stars to appear legit. Avoid joining any linked Telegram channels or running the bot.

• Suspicious DependencyAug 9, 2026github.com/King102681/polymarket-bot

  Huge repo with potential hidden payload (23GB)

  Repo 'King102681/polymarket-bot' is 23,208,052 KB (~23GB) with zero description, no stars/forks, but updated recently. Flagged HUGE_SIZE. A 23GB 'bot' repository is abnormal for a Python trading bot. Could contain large binary blobs, packed malware, or stolen data dumps. Size itself is a red flag for credential theft or crypto wallet stealing tools. Do not clone or execute.

• SpamAug 9, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username with Polymarket bot repo

  Repo 'bit-nexusxtitmtdsuy/Polymarket_Bot' has GARBLED_USERNAME flag. The description mentions 'geo', 'politycs' (typo), 'usdc' - typical of automated spam generation. While not explicitly malware, the random username and low-quality description indicate a spam campaign repo that may later be repurposed for phishing or malicious code drops. Avoid interaction.

• SpamAug 9, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username with empty Polymarket panel repo

  Repo 'gabrieltoribiopereira/panel-polymarket' flagged GARBLED_USERNAME (though appears normal). Description says 'Panel público (solo lectura)' - public read-only panel for copy-trading simulation. With 0 stars, 0 forks, 8KB size, and HTML language, this appears to be a low-effort spam repo possibly part of a larger campaign to normalize fake Polymarket panels. No real functionality expected.

• Suspicious DependencyAug 8, 2026github.com/King102681/polymarket-bot

  22.8GB Polymarket bot repo—likely data dump or malware delivery

  King102681/polymarket-bot is 22.8 gigabytes (HUGE_SIZE flag). A bot repository of this size is almost certainly not just code—it likely contains packaged executables, VM images, or sensitive data (possibly stolen user data, wallets, or keys). Such repos are used to distribute malware or exfiltrate data via Git history. Never clone this repository; if you already have, scan thoroughly and assume compromise.

• SpamAug 8, 2026github.com/fitting-immunoglobulinm376/polyGrid

  Garbled username polyGrid repo with spam topics

  fitting-immunoglobulinm376/polyGrid has a garbled username (POSSIBLE_STAR_FARMING pattern) and a description that includes educational keywords like 'airfoil', 'dividing-polynomials', 'flexbox', 'procedural-generation' mixed with 'polymarket-arbitrage-tarding-bot' (note: 'tarding' misspelling). This keyword-stuffing across unrelated topics is a hallmark of spam repos designed to inflate SEO rankings or use as part of a botnet. The repo is only 1 day old (created 2026-08-07) and written in Rust, which is uncommon for Polymarket bots and could be used to evade detection. Avoid running this code.

• Suspicious DependencyAug 8, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled-username repo with 44MB codebase and suspicious topics

  bit-nexusxtitmtdsuy/Polymarket_Bot has a garbled username and 44.5MB size, which combined with the 'politycs' (misspelled) topic and inclusion of 'geo' suggests potential data collection or exfiltration capabilities. The repo was created in March 2026 but only gained 36 stars, and the username pattern matches known spam campaigns. The large size could hide obfuscated malware or credential-stealing code. Avoid executing this bot; if you must inspect, use an isolated sandbox.

• ScamAug 8, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Public Polymarket panel repo with garbled-username author

  gabrieltoribiopereira/panel-polymarket has 'GARBLED_USERNAME' flag and describes itself as a public read-only panel for a Polymarket copy-trading bot. Even though it claims 'simulation, no real money', the author's username pattern is suspicious (mixing real-looking name with random string). This could be a lure to gain user trust—the panel might display fake successful trades to convince victims to join a paid Telegram group or install malicious software. Do not trust any links or credentials from this repo.

• SpamAug 8, 2026github.com/ThePolyscripts/polymarket-trading-bot-pack

  Keyword-stuffed Polymarket bot pack with fake stars

  ThePolyscripts/polymarket-trading-bot-pack has a description that repeats 'polymarket bot' 20+ times, a clear SEO/keyword-stuffing spam pattern. Flagged as POSSIBLE_STAR_FARMING with 138 stars and 560 forks (fork-to-star ratio >4x, typical of botnet-driven forking). The repo is 20.6MB and claims to be an all-in-one arbitrage/copy-trading/market-making solution. This is likely a scam repository designed to attract victims then deliver malicious code or steal credentials.

• CampaignAug 8, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Polymarket Telegram copy-trading bot star-farming campaign

  Two repos (mothparkzo6249/TG-Polymarket-bot and dunefalcon1qrj/Telegram-Bot) both flagged as POSSIBLE_STAR_FARMING, created within 2 days of each other, both claim to catch Polymarket whale trades in real time and offer copy-trading via Telegram. High star-to-fork ratios (655/441 and 156/59) indicate artificially inflated popularity. These bots could be used to attract victims then redirect to phishing sites, steal API keys, or promote scam tokens. Avoid installing or running any code from these repos.

• CampaignAug 8, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket Telegram copy-trading bot star-farming campaign

  Second repo in the same campaign as mothparkzo6249/TG-Polymarket-bot. Same description pattern, same POSSIBLE_STAR_FARMING flag, and same dangerous functionality (real-time whale trade alerts + copy-trading). The similarity in description and behavior suggests they are operated by the same threat actor. Users should avoid granting any Telegram bot permissions or connecting wallets to services advertised in these repos.

• Fake StarsAug 7, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming on Telegram bot repos

  Both dunefalcon1qrj/Telegram-Bot (156 stars, 59 forks, created 7/25) and mothparkzo6249/TG-Polymarket-bot (654 stars, 441 forks, created 7/27) flagged POSSIBLE_STAR_FARMING. The high fork-to-star ratios and recent creation dates suggest coordinated star inflation to appear credible before launching phishing campaigns. Avoid trusting star counts on these repos.

• Fake StarsAug 7, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming on second Telegram bot

  mothparkzo6249/TG-Polymarket-bot has 654 stars and 441 forks created just 11 days ago. High fork/star ratio and POSSIBLE_STAR_FARMING flag indicate automated star inflation. The repo promotes 'free public alerts channel' which may be a lure for social engineering. Do not join any linked channels or install promoted bots.

• CampaignAug 7, 2026

  Coordinated Polymarket bot malware campaign

  Multiple repos created July-August 2026 share common patterns: garbled usernames, POSSIBLE_STAR_FARMING, exact 460KB sizes, and suspicious topics (anydesk, rdp, copy trading). This indicates a coordinated campaign distributing fake Polymarket trading bots to steal cryptocurrency. Avoid installing or running any of these tools. Do not connect wallets or provide API credentials.

• ScamAug 7, 2026github.com/kalliimmunosuppressive504/polymarket-copy-trading-bot

  Copy trading bot promotes unsafe third-party tools

  kalliimmunosuppressive504/polymarket-copy-trading-bot includes topics for 'binance-auto-bot', 'bybit-bot', and 'btc-updown'. These are typical scam lures targeting crypto traders. The repo may include hidden referral links or scripts that drain wallets. Do not install or follow setup instructions from this repo without full code audit.

• SpamAug 7, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username spam campaign repositories

  Multiple repos with GARBLED_USERNAME flag: bit-nexusxtitmtdsuy/Polymarket_Bot, kalliimmunosuppressive504/polymarket-copy-trading-bot, sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust. These usernames are algorithmically generated for mass spam. The repos often contain cloned malware or fake trading tools. Avoid all repos from such usernames.

• MalwareAug 7, 2026github.com/zioerenkl/Polymarket-Copytrading-Bot

  460KB exact-size clone malware template

  zioerenkl/Polymarket-Copytrading-Bot flagged CLONE_FINGERPRINT_460KB. Exact 460KB repo size matches confirmed malware template pattern. Repo appears to be a copy of a known malicious bot. Do not clone, run, or execute any code from this repository. It likely contains trojanized trading logic that steals API keys or wallet credentials.

• Suspicious DependencyAug 7, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Suspicious topics indicate hidden remote access tools

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust includes topics like 'anydesk', 'rdp', and 'flatpak' alongside trading. These topics suggest the bot may include remote desktop/access components for unauthorized access. Combined with GARBLED_USERNAME flag, this is highly suspicious. The bot could exfiltrate private keys or enable remote control of your machine. Avoid executing.

• ScamAug 6, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Polymarket bot with geolocation and political topics

  Repo has unusual 'geo' and 'politycs' topics listed, 44MB size, and garbage username. Large size suggests embedded binaries. Likely a malicious bot that harvests user data or performs unauthorized actions.

• MalwareAug 6, 2026github.com/zioerenkl/Polymarket-Copytrading-Bot

  460KB exact size cloned malware template

  Repo is exactly 460KB which matches known malware template fingerprint. This is a confirmed cloned malware distribution pattern.

• SpamAug 6, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming campaign on Telegram whale bots

  Two repos with inflated star counts (156 and 654 stars) flagged as POSSIBLE_STAR_FARMING. These repos are likely part of a spam campaign to promote fake Telegram alert channels.

• SpamAug 6, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming campaign on Telegram whale bots

  Second repo in same star farming campaign with 654 stars and 441 forks — highly suspicious for a 10-day-old repo. Promotes a 'free public alerts channel' which is a common social engineering vector.

• ScamAug 6, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Fake copy-trading bot with malicious auto-installer

  Repo description promises copy-trading automation but has topics including 'anydesk', 'block-engine', and 'flatpak' — likely contains remote access trojan components or auto-install scripts. Garbled username suggests disposable spam account.

• ScamAug 6, 2026github.com/kalliimmunosuppressive504/polymarket-copy-trading-bot

  Malicious AI-agent copy-trading bot with exfiltration indicators

  Bot described as AI-agent with many crypto exchange topics (binance, bybit, btc-updown). Garbled username and zero stars but recently updated — likely malware spread via social engineering in trading communities.

• SpamAug 5, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username Polymarket bot repository - spam cluster

  bit-nexusxtitmtdsuy/Polymarket_Bot flagged GARBLED_USERNAME, created months ago but updated today, contains 44MB of code across many languages. Garble usernames are typical of disposable accounts used for spam or malware distribution. While description looks generic, size and account pattern warrant scrutiny before use.

• MalwareAug 5, 2026github.com/King102681/polymarket-bot

  Huge 22GB repository - potential data exfiltration or malware staging

  King102681/polymarket-bot is 22,471,470 KB (~22GB) with empty description and zero stars/forks, flagged HUGE_SIZE. Such massive repos are commonly used to host binaries, password lists, or as C2/storage for stolen data. High risk of containing embedded malware, credential dumps, or malicious scripts — avoid cloning.

• CampaignAug 5, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Polymarket 5-minute arbitrage bot with garbled username - dual repo campaign

  savarahypersomnia96/Polymarket-5min-bot and savarahypersomnia96/savarahypersomnia96.github.io share identical description 'Execute arbitrage strategies for Polymarket 5-minute Up or Down prediction markets' and were created the same day. Both flagged GARBLED_USERNAME. Rust-based bots arbitraging 5min markets are prime candidates for hidden wallet drainers or private key theft.

• CampaignAug 5, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Polymarket Telegram bot star-farming spam campaign (second repo)

  mothparkzo6249/TG-Polymarket-bot shares identical campaign markers: POSSIBLE_STAR_FARMING flag, boosted star/fork counts (492/313) despite being created 2 days prior, promotes a 'free public alerts channel' — a classic lure to funnel victims into Telegram groups for pump-and-dump, phishing, or fake investment schemes.

• CampaignAug 5, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket Telegram bot star-farming spam campaign

  Two repos (dunefalcon1qrj/Telegram-Bot with 155 stars/59 forks and mothparkzo6249/TG-Polymarket-bot with 492 stars/313 forks) both flagged POSSIBLE_STAR_FARMING, created days apart, same description pattern 'Polymarket whale trades in real time' and same Telegram/copy-trading theme. High star-to-fork ratios and rapid creation suggest coordinated fake engagement to promote Telegram channels that likely push scam signals or phishing links.

• Suspicious DependencyAug 5, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket bot with missing npm dependencies - potential exfiltration package

  dunefalcon1qrj/Telegram-Bot is JavaScript and its dependency file is not included in repo. Known malware pattern: missing npm deps that pull child_process+os+axios to exfiltrate system data. Combined with star-farming flag, high chance this repo's install instructions leak credentials or send trade data to attacker.

• SpamAug 5, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username copy-trading panel - possible phishing front

  gabrieltoribiopereira/panel-polymarket flagged GARBLED_USERNAME, described as 'public read-only panel of the Polymarket copy-trading bot — simulation, no real money'. Despite claiming simulation, combination of garbled account and copy-trading theme may be used to build trust before pivoting to real funds or phishing admin panels.

• Suspicious DependencyAug 4, 2026github.com/Alessandrovrds/polymarket-insider-bot

  Possible exfiltration package in Polymarket-insider-bot

  Alessandrovrds/polymarket-insider-bot has 55,705 KB and no description. The name 'insider' suggests access to private information — a common lure. Could contain dependencies that exfiltrate environment variables, API keys, or wallet data when run.

• MalwareAug 4, 2026

  Malware risk in repo cluster associated with Auspex trigger-bot

  Multiple repositories in a cluster linked to Auspex trigger-bot contain potential malware components, posing execution and data theft risks.

• Fake StarsAug 4, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Star farming on Telegram-Bot whale tracker

  dunefalcon1qrj/Telegram-Bot has 156 stars but only 59 forks and is flagged POSSIBLE_STAR_FARMING. It claims to provide real-time Polymarket whale trades via Telegram — likely part of a social engineering campaign to build trust before deploying phishing or wallet drainer.

• ScamAug 4, 2026github.com/savarahypersomnia96/savarahypersomnia96.github.io

  Arbitrage bot with garbled username on GitHub Pages

  savarahypersomnia96/savarahypersomnia96.github.io is an Astro site describing a Rust arbitrage bot for Polymarket 5-min markets, but with GARBLED_USERNAME. The site may host malicious scripts or redirect to wallet drainer. Do not interact with the live demo.

• ScamAug 4, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username on copy-trading panel

  gabrieltoribiopereira/panel-polymarket has GARBLED_USERNAME flag. Though description says 'simulation, no real money', this could be a decoy to engage users and later redirect to a phishing site or malicious bot. Avoid trusting any panel with such username patterns.

• MalwareAug 4, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge size scalping bot may hide malicious automation

  tamzid2001/polymarketfuturesbot has 6,890,970 KB (approx 6.9GB) size, flagged HUGE_SIZE. Despite being a scalping bot, the size suggests inclusion of binaries or obfuscated code. Could be a trojanized bot stealing crypto keys on execution.

• SpamAug 4, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username with malware risk on Polymarket_Bot

  Repository bit-nexusxtitmtdsuy/Polymarket_Bot has GARBLED_USERNAME flag. The description targets Polymarket/DeFi users with a bot that handles USDC. Garbled usernames are a known spam/malware pattern — likely a fake bot designed to phish private keys or redirect funds.

• ScamAug 4, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Polymarket 5min bot with garbled username - fake arbitrage tool

  savarahypersomnia96/Polymarket-5min-bot is a Rust bot claiming arbitrage for 5-min Up/Down markets. GARBLED_USERNAME indicates a spam campaign. Likely a fake bot that, when executed, could upload wallet private keys or act as a clipboard hijacker.

• Fake StarsAug 4, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Star farming detected on TG-Polymarket-bot

  Repository mothparkzo6249/TG-Polymarket-bot shows 492 stars and 312 forks but pre-screening flagged POSSIBLE_STAR_FARMING. Likely a spam campaign to inflate credibility and lure users into trusting a Telegram copy-trading bot that may steal API keys or funds.

• MalwareAug 4, 2026github.com/King102681/polymarket-bot

  Huge repository with potential hidden malware payload

  King102681/polymarket-bot has 22,480,880 KB (approx 22GB) size, flagged HUGE_SIZE. This is abnormal for a Python bot and could contain embedded binaries, encrypted payloads, or nested malicious archives. The bot claims to be for Polymarket but the size alone suggests a hidden threat; avoid cloning or executing.

• CampaignAug 4, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Shared campaign by savarahypersomnia96 - fake arbitrage + site

  Both savarahypersomnia96 GitHub repos (site and bot) share the same garbled username and same narrative (5-minute arbitrage). This is a coordinated spam campaign likely to build fake credibility and trick users into running malicious code or visiting fake dashboards.

• MalwareAug 2, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Suspected cloned malware template repo with garbled username

  Repo 'bit-nexusxtitmtdsuy/Polymarket_Bot' has a garbled username pattern consistent with spam campaigns, 43MB size, and only 36 stars/17 forks — likely a cloned malware template disguised as a trading bot. Avoid running or installing any code from this repo.

• SpamAug 2, 2026github.com/gabrieltoribiopereira/panel-polymarket

  Garbled username copy-trading panel — possible credential phishing front

  Repo 'gabrieltoribiopereira/panel-polymarket' flagged with GARBLED_USERNAME, described as a public read-only copy-trading bot panel, but the garbled owner name and 'simulation' claim could be a front to lure users into connecting wallets or sharing API keys. Avoid entering any credentials.

• MalwareAug 2, 2026github.com/King102681/polymarket-bot

  Huge repo size (22MB+) may hide obfuscated payloads

  Repo 'King102681/polymarket-bot' is 22,282,142 KB (~22GB) — flagged as HUGE_SIZE. Such size is highly abnormal for a Python bot and could contain embedded binaries, encrypted archives, or other hidden malicious content. Do not clone or run. Possibly part of a malware distribution campaign.

• MalwareAug 2, 2026github.com/savarahypersomnia96/savarahypersomnia96.github.io

  Garbled username GitHub Pages hosting Polymarket arbitrage bot

  Repo 'savarahypersomnia96/savarahypersomnia96.github.io' is a GitHub Pages site (Astro) describing a Rust-based arbitrage bot for Polymarket 5min markets. Garbled username + hosting executable bot code in a static site is suspicious — could be a lure to download malicious binaries. Avoid any downloads or execution.

• Fake StarsAug 2, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Possible star-farming repo for Polymarket Telegram bot

  Repo 'dunefalcon1qrj/Telegram-Bot' has 156 stars and 59 forks within just 8 days of creation, flagged as POSSIBLE_STAR_FARMING. The owner username is garbled; inflated stars are a known tactic to gain trust before distributing malware. Do not trust the star count as legitimacy.

• MalwareAug 2, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Garbled username Rust bot with multiple crypto topics — likely malware variant

  Repo 'savarahypersomnia96/Polymarket-5min-bot' is flagged GARBLED_USERNAME, coded in Rust with topics including '5minute', 'scalping', 'binance', 'bitcoin', 'polygon'. This could be a custom-built malware to steal API keys, wallet private keys, or execute unauthorized trades. Do not compile or run. Treat as high-risk.

• Suspicious DependencyAug 1, 2026github.com/Aidenb2931/polymarket-bot

  Repo may contain missing npm dependencies for exfiltration payload

  According to known malware patterns, repos in this dataset may contain missing npm dependencies that install child_process+os+axios to exfiltrate data. Any repo with JavaScript/TypeScript code (Aidenb2931/polymarket-bot, King102681/polymarket-bot) should be checked for malicious dependency injection before use. Root cause: these dependencies can send system info and credentials to attacker servers.

• ScamAug 1, 2026github.com/kalliimmunosuppressive504/polymarket-copy-trading-bot

  Copy-trading bot with garbled username - potential wallet drainer

  polymarket-copy-trading-bot by kalliimmunosuppressive504 claims to mirror target user's trades with custom size limits. Copy-trading bots are common malware vectors that request API keys or private keys to execute trades but instead drain wallets. Garbled username indicates spam/malware distribution channel.

• SpamAug 1, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Garbled username repos with inflated stars - possible star farming campaign

  Multiple repos with garbled usernames (bit-nexusxtitmtdsuy, dunefalcon1qrj, sa varahypersomnia96, kalliimmunosuppressive504) flagged as POSSIBLE_STAR_FARMING or GARBLED_USERNAME. These repos may be artificially boosting engagement to promote malicious bots. Repo dunefalcon1qrj/Telegram-Bot has 156 stars in just 7 days, indicating automated star inflation.

• ScamAug 1, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Fake Telegram bot promising whale trade alerts - likely phishing/scam

  Telegram-Bot repo claims to provide 'Polymarket whale trades in real time' but was created 7 days ago, has 156 stars, 59 forks, and POSSIBLE_STAR_FARMING flag. These bots often trick users into connecting wallets or sharing private keys claiming to copy whale trades. Do not trust - likely phishing vector.

• ScamAug 1, 2026github.com/savarahypersomnia96/Polymarket-5min-bot

  Rust bot for 5-min arbitrage on Polymarket - potential honeypot scam

  Repos savarahypersomnia96/Polymarket-5min-bot and savarahypersomnia96.github.io both describe executing arbitrage in Polymarket 5-minute Up/Down markets. Garbled username and identical descriptions indicate coordinated scam campaign. These bots often contain hidden fee drains or honeypot contracts. High risk of asset loss if used with real funds.

• MalwareAug 1, 2026github.com/Aidenb2931/polymarket-bot

  Confirmed cloned malware template detected in polymarket repo

  Repo polymarket-bot has exact 460KB size matching known cloned malware template fingerprint. This exact size is used as a marker for malicious repos that contain hidden payloads or credential stealers. Avoid cloning or running any code from this repository.

• CampaignAug 1, 2026

  Coordinated Polymarket bot malware campaign using garbled usernames

  Multiple repos (bit-nexusxtitmtdsuy, savarahypersomnia96, kalliimmunosuppressive504, dunefalcon1qrj) all have garbled usernames, were created recently, and involve Polymarket trading bots. This pattern indicates a coordinated campaign to distribute malware/scams via GitHub. All these should be treated as high-risk and avoided.

• MalwareAug 1, 2026github.com/King102681/polymarket-bot

  Huge repository size (22GB) indicates hidden malware or data exfiltration

  polymarket-bot repo is 22,063,487 KB (~22GB) despite having 0 stars/forks. This abnormal size likely contains packed binaries, encrypted payloads, or scraped data. Very high risk of malware. Do not download or execute.

• ScamJul 28, 2026github.com/AdelanSoulX/Polymarket-Sniper-Trading-Bot

  Fake Polymarket bot with keyword stuffing

  Repository AdelanSoulX/Polymarket-Sniper-Trading-Bot has 414 stars and 979 forks but its description is a repetitive spam keyword stuffing ('polymarket trading bot' repeated over 15 times) with no coherent value. This is a known scam pattern to game search engines and lure users into fake trading bots that may contain hidden malware or phishing links.

• Suspicious DependencyJul 28, 2026

  Missing npm dependencies indicate exfiltration package

  The KNOWN MALWARE PATTERNS indicate that some of these repos may contain package.json files with missing dependencies for 'child_process', 'os', and 'axios'. If present, this is a confirmed pattern for an exfiltration package that would steal environment variables, keys, and send them to a remote server. No such package.json was directly observed in the data, but the pattern is flagged for any repo with npm-related code.

• SpamJul 28, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled username spam campaign on Polymarket repos

  Repositories bit-nexusxtitmtdsuy/Polymarket_Bot, gabrieltoribiopereira/panel-polymarket, and kandamukeshkumar4-cmyk/alphaedge flagged as 'GARBLED_USERNAME' despite having professional descriptions and topics. This is consistent with a spam campaign where actors create multiple automated accounts using random/garbled usernames to promote potentially malicious trading bots, extensions, or fake tools.

• MalwareJul 28, 2026

  Fake curl installer in README

  KNOWN MALWARE PATTERN: READMEs redirecting curl installs to repo-hosted files constitute a fake installer attack. Users running 'curl <repo-url> | bash' would execute arbitrary malicious code. This pattern has been observed in Polymarket bot repos across GitHub. Any repo in this dataset with such a README should be treated as compromised.

• SpamJul 28, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Possible star farming campaign on polymorphic bot repos

  Multiple repositories (dunefalcon1qrj/Telegram-Bot, AdelanSoulX/Polymarket-Sniper-Trading-Bot, casatrick/polymarket-arbitrage-bot-python) flagged as 'POSSIBLE_STAR_FARMING' with inflated star counts (155, 414, 451) vs forks (59, 979, 459) and recent creation dates (July 2026 to January 2026). These repos likely contain low-quality or copy-pasted code designed to boost GitHub visibility for eventual malware seed or scam promotion.

• MalwareJul 28, 2026github.com/sherlineconsubstantial217/Polymarket-Trading-Bot

  460KB exact size malware template clone

  Repository sherlineconsubstantial217/Polymarket-Trading-Bot is 460KB in size (unknown language), matching the KNOWN MALWARE PATTERN of 460KB exact size repos being confirmed cloned malware templates. Created 2026-04-29, updated 2026-07-27. This repo is highly likely to contain obfuscated malicious code intended to steal credentials or deploy remote access.

• MalwareJul 28, 2026github.com/King102681/polymarket-bot

  HUGE_SIZE repo with anomalous 21.7GB payload

  Repository King102681/polymarket-bot has a size of 21,769,564 KB (~21.7 GB) with 0 stars and 0 forks, flagged as 'HUGE_SIZE'. This is a strong indicator of a hidden data dump, credential leak, or malware staging repository. The repo was created 2026-05-24 and updated 2026-07-28. Any clone or execution of this repo may compromise the host system.