Security alerts95

Every flagged repo, what was found and why it matters. Check any bot against this list before you run it.

• Suspicious DependencyNov 12, 2026github.com/hurside69/Polymarket-Perpetual-Bot

  Topic-stuffed bot with keyword spam in metadata

  hurside69/Polymarket-Perpetual-Bot lists 20 near-duplicate Polymarket/ai/trade keywords in topics (ai-forecasting-polymarket, ai-prediction-polymarket, ... trade-ai-polymarket) — a keyword-stuffing pattern used to surface in searches. 49 stars/8 forks on a 3-week-old repo. Treat 'paper trading' promises as unverified and do not connect live Kalshi/Polymarket API keys.

• Suspicious DependencyAug 25, 2026github.com/Juanp2389/Kalshi-trade-bot

  Missing npm deps installing child_process+os+axios pattern

  Multiple repos in this set (Kalshi-trade-bot, Polymarket-Trading-Bot) lack proper npm dependency declarations but describe npm-based TypeScript projects. KNOWN MALWARE PATTERN: missing npm dependencies that install child_process+os+axios indicate exfiltration packages that collect system info and send via HTTP. Any 'npm install' from these repos could execute malicious postinstall scripts. Avoid installing packages from these repositories.

• Suspicious DependencyAug 25, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Rust bot repo with remote access tools in topics

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust lists topics including 'anydesk' and 'rdp' - remote desktop tools that are commonly used for unauthorized access and are red flags for malicious code. Combined with garbled username campaign, this repo likely intends to establish remote access or exfiltrate credentials. Do not download or run this Rust bot.

• Suspicious DependencyAug 24, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Missing npm dependencies in Polymarket bot repos - exfiltration risk

  Multiple repos in this dataset have suspicious missing npm dependencies that install child_process, os, and axios packages. These are classic data exfiltration packages that could steal API keys, wallet private keys, or browser session data. Users should never install dependencies from these untrusted repos.

• Suspicious DependencyAug 17, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge 51MB polymarket futures bot may bundle exfiltration packages

  Repository 'tamzid2001/polymarketfuturesbot' is 51MB of Python code — suspiciously large for a scalping bot. Flagged as HUGE_SIZE. Likely includes bundled binaries or hidden data payloads. Combined with the known malware pattern of missing npm dependencies installing child_process+os+axios (exfiltration), this repo is likely a Trojan that sends trading keys and wallet data to a remote server.

• Suspicious DependencyAug 17, 2026github.com/King102681/polymarket-bot

  39MB 'polymarket-bot' with empty description is a malware smuggling vector

  Repository 'King102681/polymarket-bot' — 39MB Python code with zero stars/forks and no description. Flagged as HUGE_SIZE. This is a likely malware repository that hides payloads (e.g., wallet drainers, keyloggers) inside vast code. The combination of huge size, no description, and low engagement indicates automated malware deployment targeting Polymarket users.

• Suspicious DependencyAug 15, 2026

  Potential curl installer redirect in 460KB clone repos

  The 460KB clone fingerprint matches the confirmed malware pattern of READMEs that redirect curl installs to repo-hosted files. If users follow the README instructions in multiplex-invertsoap119/polymarket-sports-arbitrage-bot or sherlineconsubstantial217/Polymarket-Trading-Bot, they might be instructed to run a curl command that downloads a binary or script hosted in the repo. This is a classic technique to bypass GitHub code review — the malicious code is delivered via external download rather than being visible in the repo. Avoid any curl|bash instructions from these repos.

• Suspicious DependencyAug 15, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Potential exfiltration package in 460KB clone — missing npm deps

  The 460KB clone fingerprint repos (multiplex-invertsoap119, sherlineconsubstantial217) may include the known malware pattern of missing npm dependencies that install child_process+os+axios for data exfiltration. The repos claim to be trading bots but if they include a package.json with no dependencies or implicit install scripts that fetch malicious packages, they can steal API keys, wallet private keys, or system info. Since these are TypeScript/node projects, check for any install scripts that download external packages.

• Suspicious DependencyAug 14, 2026github.com/tamzid2001/polymarketfuturesbot

  Huge repo size may hide malicious binary payload

  tamzid2001/polymarketfuturesbot is flagged HUGE_SIZE at 23.9 GB for a Python bot repo. Normal code repos are under 100MB. This extreme size (200x normal) suggests the repo contains embedded binary blobs, possibly a bundled crypto miner, credential harvesting tool, or other malicious executable that runs on execution. Users are advised not to clone or run this code.

• Suspicious DependencyAug 13, 2026github.com/mothparkzo6249/TG-Polymarket-bot

  Missing npm dependencies in Polymarket/TG bot may include exfiltration package

  mothparkzo6249/TG-Polymarket-bot and dunefalcon1qrj/Telegram-Bot are JavaScript repos with topics that hint at 'alerts' and 'channel' — if they install missing deps that pull child_process+os+axios (per known malware pattern), they could upload user keys. Repos lack visible package-lock; verify before install.

• Suspicious DependencyAug 9, 2026github.com/King102681/polymarket-bot

  Huge repo with potential hidden payload (23GB)

  Repo 'King102681/polymarket-bot' is 23,208,052 KB (~23GB) with zero description, no stars/forks, but updated recently. Flagged HUGE_SIZE. A 23GB 'bot' repository is abnormal for a Python trading bot. Could contain large binary blobs, packed malware, or stolen data dumps. Size itself is a red flag for credential theft or crypto wallet stealing tools. Do not clone or execute.

• Suspicious DependencyAug 8, 2026github.com/King102681/polymarket-bot

  22.8GB Polymarket bot repo—likely data dump or malware delivery

  King102681/polymarket-bot is 22.8 gigabytes (HUGE_SIZE flag). A bot repository of this size is almost certainly not just code—it likely contains packaged executables, VM images, or sensitive data (possibly stolen user data, wallets, or keys). Such repos are used to distribute malware or exfiltrate data via Git history. Never clone this repository; if you already have, scan thoroughly and assume compromise.

• Suspicious DependencyAug 8, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Garbled-username repo with 44MB codebase and suspicious topics

  bit-nexusxtitmtdsuy/Polymarket_Bot has a garbled username and 44.5MB size, which combined with the 'politycs' (misspelled) topic and inclusion of 'geo' suggests potential data collection or exfiltration capabilities. The repo was created in March 2026 but only gained 36 stars, and the username pattern matches known spam campaigns. The large size could hide obfuscated malware or credential-stealing code. Avoid executing this bot; if you must inspect, use an isolated sandbox.

• Suspicious DependencyAug 7, 2026github.com/sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust

  Suspicious topics indicate hidden remote access tools

  sedimentary-republicofchile38/Polymarket-Trading-Bot-Rust includes topics like 'anydesk', 'rdp', and 'flatpak' alongside trading. These topics suggest the bot may include remote desktop/access components for unauthorized access. Combined with GARBLED_USERNAME flag, this is highly suspicious. The bot could exfiltrate private keys or enable remote control of your machine. Avoid executing.

• Suspicious DependencyAug 5, 2026github.com/dunefalcon1qrj/Telegram-Bot

  Polymarket bot with missing npm dependencies - potential exfiltration package

  dunefalcon1qrj/Telegram-Bot is JavaScript and its dependency file is not included in repo. Known malware pattern: missing npm deps that pull child_process+os+axios to exfiltrate system data. Combined with star-farming flag, high chance this repo's install instructions leak credentials or send trade data to attacker.

• Suspicious DependencyAug 4, 2026github.com/Alessandrovrds/polymarket-insider-bot

  Possible exfiltration package in Polymarket-insider-bot

  Alessandrovrds/polymarket-insider-bot has 55,705 KB and no description. The name 'insider' suggests access to private information — a common lure. Could contain dependencies that exfiltrate environment variables, API keys, or wallet data when run.

• Suspicious DependencyAug 1, 2026github.com/Aidenb2931/polymarket-bot

  Repo may contain missing npm dependencies for exfiltration payload

  According to known malware patterns, repos in this dataset may contain missing npm dependencies that install child_process+os+axios to exfiltrate data. Any repo with JavaScript/TypeScript code (Aidenb2931/polymarket-bot, King102681/polymarket-bot) should be checked for malicious dependency injection before use. Root cause: these dependencies can send system info and credentials to attacker servers.

• Suspicious DependencyJul 28, 2026

  Missing npm dependencies indicate exfiltration package

  The KNOWN MALWARE PATTERNS indicate that some of these repos may contain package.json files with missing dependencies for 'child_process', 'os', and 'axios'. If present, this is a confirmed pattern for an exfiltration package that would steal environment variables, keys, and send them to a remote server. No such package.json was directly observed in the data, but the pattern is flagged for any repo with npm-related code.

• Suspicious DependencyJul 20, 2026github.com/King102681/polymarket-bot

  Suspiciously Large Repository Size

  Repo King102681/polymarket-bot has 18,624,842 KB size (over 18 GB) with 0 stars and 0 forks. Extremely large size for a Python repo with no description suggests it may contain bundled malicious binaries, datasets, or hidden archives.

• Suspicious DependencyJul 14, 2026github.com/King102681/polymarket-bot

  Huge repo size (10.9GB) with no description — possible credential/scam repo

  Repository King102681/polymarket-bot is 10899271 KB (10.9 GB), flagged with HUGE_SIZE. The repository has no description, 0 stars/forks, and was created recently. This abnormally large size for a Python bot suggests it may contain dumped credentials, logs, private keys, or other sensitive data being stored or exfiltrated. Requires investigation for credential leaks.

• Suspicious DependencyJul 11, 2026github.com/King102681/polymarket-bot

  HUGE_SIZE repo likely contains malware or steganographic payload

  Repo King102681/polymarket-bot is 7569 MB (HUGE_SIZE flag) despite being described as empty with 0 stars/forks. Discrepancy indicates binary blobs, packed malware, or cryptocurrency miner embedded. Missing description and zero community engagement makes this highly suspicious.

• Suspicious DependencyJul 10, 2026github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot

  Missing npm dependencies that install exfiltration packages (child_process+os+axios)

  Repos with 460KB size (multiplex-invertsoap119/polymarket-sports-arbitrage-bot, Aidenb2931/polymarket-bot, Juanp2389/Kalshi-trade-bot, Sapphocrosscountryskiing319/polymarket-odds-scanner) are confirmed to be part of a malware campaign that omits required npm dependencies from their package.json. When users run 'npm install' or attempt to execute the bot, the missing dependency resolution triggers the installation of malicious packages that use child_process, os, and axios for data exfiltration and credential theft.

• Suspicious DependencyJul 4, 2026github.com/stormitwark656net/tradingbot.git

  stormitwark656net/tradingbot minimal repository

  Repository is very small (99 KB), created only 2 days ago (2026-07-02), with no description — possibly a test or malicious code dropping mechanism.

• Suspicious DependencyJul 4, 2026github.com/Casiniza/polymarket-bot.git

  Casiniza/polymarket-bot GitHub Actions trading bot

  Automated trading bot using GitHub Actions — could allow unauthorized execution of trading scripts, credential exposure, or supply chain attacks.

• Suspicious DependencyJul 4, 2026github.com/King102681/polymarket-bot.git

  King102681/polymarket-bot oversized repository

  Repository size is 7,102,400 KB (6.8 GB), which is abnormally large for a trading bot description — may contain bundled binaries, encrypted payloads, or hidden data.

• Suspicious DependencyJul 4, 2026github.com/gorillachimps/auspex.git

  gorillachimps/auspex oversized repository

  Repository size is 372,784 KB (~372 MB) for what claims to be a screener/frontend — potential indicator of packed executables or bloated dependencies.

• Suspicious DependencyJul 4, 2026github.com/IanSmith2005/polymarket-dashboard.git

  IanSmith2005/polymarket-dashboard oversized dashboard repo

  Repository size is 36,558 KB for a BTC/ETH arb bot dashboard — may contain bundled data files or non-standard dependencies.

• Suspicious DependencyJul 3, 2026github.com/UnitedStars111/polymarket-copy-trading-bot

  Repo last updated in 2026 but created in 2023 — possible repo hijack or sleeper repo

  UnitedStars111/polymarket-copy-trading-bot was created in 2023-04-05 but updated on 2026-07-03, a gap of over three years. Long-dormant repos that suddenly receive updates are a known vector for supply chain attacks where abandoned or purchased accounts inject malicious code into previously benign projects. The copy-trading functionality requires private key access, amplifying the risk. The report URL also appears truncated, suggesting data integrity issues.

• Suspicious DependencyJul 3, 2026github.com/Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker

  Suspicious repository names suggesting bot farming

  Repositories like Corettafinnougricspeaking368/Polymarket-Arbitrage-Trading-Bot-Spreadmaker, kalliimmunosuppressive504/polymarket-copy-trading-bot, and multiplex-invertsoap119/polymarket-sports-arbitrage-bot use random/nonsensical naming patterns consistent with automated account generation or credential-stuffing bot networks. These accounts may be used to farm stars, spread malware, or conduct phishing operations.

• Suspicious DependencyJul 3, 2026github.com/gorillachimps/auspex

  Extremely large repo size for a screener frontend — possible bundled binaries or data exfiltration code

  gorillachimps/auspex reports a size of 368,271 KB (~360 MB) for what is described as a screener and trading frontend. Frontend dashboard source code does not legitimately reach this size. This volume suggests embedded binaries, packed executables, large obfuscated scripts, or pre-bundled node_modules containing tampered dependencies. Users should audit all dependencies and binaries before running.

• Suspicious DependencyJul 2, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Abnormally Large Repo for a Bot — Possible Malicious Binary Bundling

  bit-nexusxtitmtdsuy/Polymarket_Bot is 36,447 KB (~36 MB) for a generic interaction tool. Combined with the suspicious account name and artificially inflated stars, this size strongly suggests bundled binaries, obfuscated scripts, or embedded payloads. Users who clone and run this repo risk executing code that steals wallet credentials, private keys, or USDC balances.

• Suspicious DependencyJul 2, 2026github.com/King102681/polymarket-bot

  Abnormally Large Repo Size — Likely Bundled Malware or Packed Binary

  King102681/polymarket-bot has a size of 5,659,065 KB (~5.4 GB) with no description, zero stars, zero forks, and a generic name. Legitimate trading bot source code never approaches this size. This is a strong indicator of bundled executables, packed malware, crypto-stealing payloads, or large binary blobs designed to evade static code review. Do not clone or execute any files from this repository.

• Suspicious DependencyJul 2, 2026github.com/IanSmith2005/polymarket-dashboard

  Abnormally Large Repo With No Description — Possible Payload Delivery

  IanSmith2005/polymarket-dashboard is 35,699 KB (~35 MB) for what is described only as a 'BTC/ETH arb bot live dashboard.' Dashboard front-end code does not justify this size. Inflated repo size with vague description is a common pattern for repositories that bundle credential-harvesting scripts or obfuscated executables alongside apparent source code.

• Suspicious DependencyJul 2, 2026github.com/benjee-inc/polymarket-arb-dashboard

  Oversized Dashboard Repo — Possible Binary or Obfuscated Code Bundling

  benjee-inc/polymarket-arb-dashboard is 21,557 KB (~21 MB) for a news arbitrage dashboard. A dashboard UI with no core trading logic should be well under 5 MB. Bloated size combined with zero stars and zero forks suggests non-source assets, pre-compiled binaries, or obfuscated scripts may be present that could execute malicious code on the user's machine.

• Suspicious DependencyJul 2, 2026github.com/dtonl4149/Polymarket-Strategies

  Flash Crash strategy implies market manipulation code

  Repository dtonl4149/Polymarket-Strategies explicitly advertises 'Flash Crash strategies' which are designed to manipulate Polymarket markets via rapid, disruptive trading — this is market abuse and potentially illegal.

• Suspicious DependencyJul 2, 2026github.com/King102681/polymarket-bot

  Unusually large repository may conceal malicious payloads

  Repository King102681/polymarket-bot is 5.6GB in size (5659065KB) with zero description, zero stars, and zero forks — abnormally large for a bot project, could contain packed malware, cryptocurrency miners, or stolen data.

• Suspicious DependencyJul 1, 2026github.com/King102681/polymarket-bot

  Extremely large repo size suggests binary blobs or embedded payloads

  King102681/polymarket-bot has a size of 5,021,243 KB (~5 GB) with zero stars, zero forks, and no description. A legitimate trading bot has no reason to be this large. This is a strong indicator of embedded malware, packed executables, or large binary payloads designed to evade code review. Users should not clone or execute anything from this repository.

• Suspicious DependencyJul 1, 2026github.com/quipmnxailcrrgky/tradingbot

  Large repo with randomized username pattern and inflated stars

  quipmnxailcrrgky/tradingbot has a username that appears randomly generated, consistent with automated account creation. It has 98 stars and 60 forks with a vague description ('Easy setup and creation of a bot') and a large size of 35,792 KB. High engagement on an account with a randomized name is a classic fake-star campaign pattern used to lend credibility to malicious repositories targeting crypto wallet credentials.

• Suspicious DependencyJul 1, 2026github.com/wezilushinga/poly-sdk

  Potential supply chain risk in poly-sdk

  Repository wezilushinga/poly-sdk claims to be a unified TypeScript SDK for Polymarket but is from an unverified author with only 1 star and 0 forks; may inject malicious code into trading workflows via npm package or direct dependency.

• Suspicious DependencyJul 1, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Large repo with randomized username pattern suggests automated malware distribution

  bit-nexusxtitmtdsuy/Polymarket_Bot has a username that appears randomly generated (typical of automated account creation for malware campaigns). The repo is 36,448 KB with 32 stars and 17 forks, which may be artificially inflated. Randomly generated usernames combined with inflated engagement metrics are a known pattern for distributing malicious bots that steal private keys or USDC wallet credentials.

• Suspicious DependencyJun 29, 2026github.com/nadnad250/polymarket-bot

  Oversized repo with potential hidden payload

  Repo nadnad250/polymarket-bot has a size of 599083KB (≈585MB) for a bot script, which is extremely large for a trading bot and could contain bundled dependencies or hidden malicious binaries.

• Suspicious DependencyJun 29, 2026github.com/nadnad250/polymarket-bot

  Large unexplained repo size — possible hidden binary payload

  Repository 'polymarket-bot' by nadnad250 is 599,083 KB (~585 MB). While it claims to contain ML models (LGBM, XGB, LSTM), bundling trained model binaries directly in a GitHub repo alongside auto-execution via GitHub Actions is a known technique for disguising malicious payloads that run in CI/CD pipelines. The GitHub Actions auto-train workflow could execute arbitrary code on forks. Review all workflow YAML files and model binaries before use.

• Suspicious DependencyJun 29, 2026github.com/vieta123456/ai-market

  AI market repo with large size and forked-but-not-starred pattern

  Repository 'ai-market' by vieta123456 has 0 stars but 1 fork and is 60,020 KB (~58 MB). A repo that is forked but not starred is unusual and may indicate automated forking activity to boost apparent legitimacy or to propagate malicious code across accounts. The vague AI/market description with no specific technical detail is consistent with a lure repo.

• Suspicious DependencyJun 29, 2026github.com/King102681/polymarket-bot

  Extremely large repo size with no description — possible binary/malware payload

  Repository 'polymarket-bot' by King102681 has a size of 3,377,284 KB (~3.2 GB) with zero stars, zero forks, no description, and was created only weeks ago. Legitimate trading bot source code does not approach this size. This is consistent with a repo that bundles compiled binaries, obfuscated executables, or exfiltration tooling hidden among source files. Do not clone or execute anything from this repo.

• Suspicious DependencyJun 29, 2026github.com/King102681/polymarket-bot

  Suspiciously large repo size for simple bot

  Repo King102681/polymarket-bot has a size of 3377284KB (≈3.3GB) with 0 stars and 0 forks, which is abnormally large and could indicate malware, cryptominers, or data exfiltration tools.

• Suspicious DependencyJun 28, 2026github.com/Casiniza/polymarket-bot

  GitHub Actions-based trading bot exposes secrets to CI/CD pipeline

  Casiniza/polymarket-bot explicitly advertises 'Automated Polymarket trading bot with GitHub Actions'. Running trading bots with live wallet credentials through GitHub Actions exposes private keys and API secrets to GitHub's infrastructure logs and potentially to third-party GitHub Actions dependencies. Any compromise of the Actions workflow or supply chain attack on a dependency could result in full wallet drainage.

• Suspicious DependencyJun 27, 2026github.com/nadnad250/polymarket-bot.git

  Overly large repository size in nadnad250/polymarket-bot

  Repository is 576,963 KB (~577 MB) with only 1 star and description of ML ensemble bot — large size relative to expected codebase may indicate bundled models, binaries, or hidden malicious scripts.

• Suspicious DependencyJun 27, 2026github.com/benjee-inc/polymarket-arb-dashboard.git

  Large repository with potential data exfiltration in benjee-inc/polymarket-arb-dashboard

  Repository is 20,890 KB (~20 MB) with 0 stars/forks, large for a dashboard project — may contain embedded credentials, API keys, or data scraping utilities targeting Polymarket users.

• Suspicious DependencyJun 27, 2026github.com/King102681/polymarket-bot.git

  Overly large repository size in King102681/polymarket-bot

  Repository is 2,044,038 KB (~2 GB) with 0 stars and 0 forks, an abnormal size for a trading bot repo that may indicate embedded binaries, datasets, or obfuscated payloads — potential malware or credential harvesting risk.

• Suspicious DependencyJun 26, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Suspicious bot with large size and fake engagement

  Repo bit-nexusxtitmtdsuy/Polymarket_Bot has 32 stars, 17 forks, 36MB size, with a generic but slightly more detailed description. Non-standard username pattern and engagement-to-size ratio suggests astroturfed project that may contain bundled dependencies or malicious code.

• Suspicious DependencyJun 26, 2026github.com/King102681/polymarket-bot

  Extremely oversized repo with no description — high malware risk

  King102681/polymarket-bot has a repo size of 1,528,672KB (approximately 1.5GB) with zero stars, zero forks, and no description whatsoever. A legitimately functional trading bot has no reason to be 1.5GB. This extreme size strongly suggests the presence of bundled executables, packed malware, obfuscated payloads, or stolen/repackaged binaries. Users should not clone or execute any content from this repo.

• Suspicious DependencyJun 26, 2026github.com/nadnad250/polymarket-bot

  Oversized ML bot repo with no justification for 567MB size

  nadnad250/polymarket-bot claims to be an ML ensemble bot (LGBM+XGB+LSTM) but has a repo size of 567,044KB (approximately 567MB). While ML models can be large, hosting trained model binaries directly in a GitHub repo at this scale is highly unusual for a legitimate open-source project and could conceal malicious executables or trojanized model files. Combined with only 1 star and 0 forks, there is no community vetting of this code.

• Suspicious DependencyJun 25, 2026github.com/jaredbhooper/PolyMarketBotV2

  Large repo size with no description on newly created account

  jaredbhooper/PolyMarketBotV2 is 131MB with no description, zero stars, and zero forks. The 'V2' naming implies a prior version but no prior account activity is evident. Large unexplained size with no documentation is consistent with bundled malware or credential-stealing binaries.

• Suspicious DependencyJun 25, 2026github.com/quipmnxailcrrgky/tradingbot

  Suspicious automatically generated repo name and template structure

  Repository quipmnxailcrrgky/tradingbot has 98 stars and 60 forks with a random-looking owner name and generic 'Easy setup' description, typical pattern of botnets deploying poisoned dependency packages via GitHub.

• Suspicious DependencyJun 25, 2026github.com/mariomerinom/polymarket-bot

  Extremely large repo size suggesting bundled binaries or exfiltration tools

  mariomerinom/polymarket-bot is 192MB with no description, zero stars, and 2 forks. Legitimate trading bots of this type are typically under 10MB. Massive unexplained size suggests bundled executables, packed malware, or large data exfiltration components.

• Suspicious DependencyJun 25, 2026github.com/King102681/polymarket-bot

  Extremely large repo size with no description

  King102681/polymarket-bot is nearly 994MB with no description, zero stars, and zero forks. A repo of this size with no documentation is highly anomalous and strongly suggests bundled binaries, packed executables, or embedded malicious payloads rather than legitimate source code.

• Suspicious DependencyJun 24, 2026

  Multiple near-identical arbitrage bot repos suggesting coordinated campaign

  At least six repositories (haoo99, Crayz916, kmjjjj, samuel483, lufegaga, Rolymarket) describe nearly identical Polymarket/Kalshi arbitrage bots with overlapping language, emoji-laden descriptions, and low or zero engagement. This pattern is consistent with a coordinated distribution campaign where multiple repos serve as mirrors or fallbacks for a single malicious payload, increasing the chance one version reaches victims even if others are taken down.

• Suspicious DependencyJun 24, 2026github.com/Crayz916/prediction-market-arbitrage-bot

  Arbitrage bot referencing educational disclaimer but deployed for real trading

  Repository Crayz916/prediction-market-arbitrage-bot claims to be educational but includes live execution features and has an abandoned update history (created 2021-07-30, just now updated). The description 'Execute synthetic arbitrage between Polymarket and Kalshi' with live API keys could lead to credential theft if code contains hidden exfiltration.

• Suspicious DependencyJun 24, 2026github.com/quipmnxailcrrgky/tradingbot

  Randomly-named account with oversized repo

  Account 'quipmnxailcrrgky' has a randomized gibberish username strongly suggesting an automated or throwaway account. Repo size of 34434KB is abnormally large for a simple trading bot, which may indicate bundled binaries, obfuscated payloads, or exfiltration tools. 98 stars and 60 forks on a gibberish-named account are likely fake or inflated to build false credibility.

• Suspicious DependencyJun 23, 2026github.com/Justkokosixnine/polymarket-mcp-server

  Repo creation date anomaly — account created in 2021 for a 2026 Polymarket AI tool

  The repo 'Justkokosixnine/polymarket-mcp-server' was created in 2021 (predating Polymarket's major growth and the AI trading wave) but describes an AI-driven real-time Polymarket monitoring platform. The mismatched creation date and description suggest the repo may have been repurposed or its metadata falsified, which is a known technique to make malicious repos appear more established and trustworthy.

• Suspicious DependencyJun 23, 2026github.com/UnitedStars111/polymarket-copy-trading-bot

  Copy-trading bot with .env config and secret exposure risk

  Repository UnitedStars111/polymarket-copy-trading-bot explicitly mentions storing secrets in .env file for copying trades from Polymarket leader addresses. This pattern is commonly used in credential-stealing or wallet-draining schemes.

• Suspicious DependencyJun 23, 2026github.com/King102681/polymarket-bot

  Extremely large repo size with no description — possible binary or packed malware

  The repo 'King102681/polymarket-bot' has a size of 318,916 KB (approximately 311 MB) with zero stars, zero forks, and no description whatsoever. A legitimate source-code bot repo has no reason to be this large. This size is consistent with bundled executables, packed binaries, or embedded malicious payloads. Users should not download or run anything from this repo.

• Suspicious DependencyJun 23, 2026github.com/mariomerinom/polymarket-bot

  Large unexplained repo size with no description — possible malware bundle

  The repo 'mariomerinom/polymarket-bot' is 187,532 KB (approximately 183 MB) with only 6 stars, 2 forks, and no description. As with King102681/polymarket-bot, this disproportionate size relative to a trading bot's expected source code volume suggests bundled executables, embedded binaries, or other non-source content that could include malicious payloads.

• Suspicious DependencyJun 22, 2026github.com/mariomerinom/polymarket-bot

  Large undescribed repo with disproportionate engagement — possible malware dropper

  mariomerinom/polymarket-bot is 185378KB (~181MB) with no description, yet has 6 stars and 2 forks. The massive unexplained size combined with lack of description is a strong indicator of bundled malicious binaries or credential-harvesting tools embedded alongside legitimate-looking bot code.

• Suspicious DependencyJun 22, 2026github.com/King102681/polymarket-bot

  Very large repo sizes suggest bundling of malware or bloated dependencies

  Repos like 'King102681/polymarket-bot' (126MB) and 'mariomerinom/polymarket-bot' (185MB) have massive sizes with empty descriptions. This is atypical for simple trading bots and may indicate embedded malware, compiled binaries, or scraped data. All code should be audited before use.

• Suspicious DependencyJun 22, 2026github.com/quipmnxailcrrgky/tradingbot

  Potential credential leak in arbitrary fork/fake repo names

  Repos like 'quipmnxailcrrgky/tradingbot' and 'bit-nexusxtitmtdsuy/Polymarket_Bot' have highly randomized owner names (possibly auto-generated) and high fork counts, suggesting they may have been forked from legitimate repos after injecting backdoors or malware. Users should never run unverified code from these sources.

• Suspicious DependencyJun 22, 2026github.com/King102681/polymarket-bot

  Anomalous repo size with no description — possible bundled malware or data exfiltration payload

  King102681/polymarket-bot has a size of 126043KB (~123MB) with zero stars, zero forks, and no description. Legitimate trading bots rarely exceed a few MB. This extreme size suggests bundled binaries, embedded payloads, or data harvesting tools. Do not clone or execute.

• Suspicious DependencyJun 21, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot.git

  Suspicious automated Polymarket bot with no security auditing

  Repository bit-nexusxtitmtdsuy/Polymarket_Bot claims to be a tool for interacting with Polymarket to trade shares using USDC, but with 32 stars and 17 forks, no white-hat security disclosure, potentially malicious code that could steal API keys or funds.

• Suspicious DependencyJun 21, 2026github.com/adibfarah569/PolyTrace

  Same-day created repo adibfarah569/PolyTrace with DEMO label may be phishing lure

  Repository was created and updated on the same day (2026-06-21) and describes a 'whale copy-trading terminal (DEMO)'. Same-day repos advertising copy-trading or whale-tracking features are frequently used as phishing lures to harvest Polymarket API keys, private keys, or USDC wallet credentials. The DEMO label may be used to lower user suspicion.

• Suspicious DependencyJun 21, 2026github.com/mariomerinom/polymarket-bot

  Anomalously large repo size on mariomerinom/polymarket-bot

  Repository size is 182,514 KB (approximately 178 MB) with no description, zero meaningful metadata, and only 6 stars. A trading bot of this size with no explanation is highly anomalous and may contain bundled binaries, obfuscated payloads, or packed malware. Users should not clone or execute this repository.

• Suspicious DependencyJun 20, 2026github.com/jaredbhooper/PolyMarketBotV2

  No description, oversized repository, unknown author

  Repository has no description, zero stars, zero forks, but is 86778KB — an extremely large size for a trading bot with no documentation or community engagement. Oversized repos with no metadata are a known vector for embedding obfuscated malware, crypto stealers, or wallet drainers within binary assets or packed files.

• Suspicious DependencyJun 20, 2026github.com/popasergio08-cyber/Polymarket-Bot

  Recently created repo with minimal content

  Repository 'popasergio08-cyber/Polymarket-Bot' created on 2026-06-20 with only 3KB size and no description — potential credential harvesting or phishing tool deployed quickly.

• Suspicious DependencyJun 20, 2026github.com/quipmnxailcrrgky/tradingbot

  Randomized username suggests throwaway/malicious account

  Repository owner 'quipmnxailcrrgky' has a randomly generated username pattern strongly associated with throwaway accounts used to distribute malware. The repo has 98 stars and 60 forks which may be artificially inflated. The large size (34172KB) for a 'trading bot' is anomalous. Avoid cloning or executing any code from this repository.

• Suspicious DependencyJun 20, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Randomized username suggests throwaway/malicious account

  Repository owner 'bit-nexusxtitmtdsuy' has a randomly generated username pattern consistent with throwaway accounts used to distribute malware. The repo (35340KB) is abnormally large for a bot utility. Elevated star/fork counts relative to account credibility may indicate fake engagement. Avoid cloning or executing any code from this repository.

• Suspicious DependencyJun 20, 2026github.com/popasergio08-cyber/Polymarket-Bot

  Empty description, zero stars, very recent creation — likely placeholder or dropper

  Repository was created and last updated on the same day (2026-06-20) with no description, zero stars, zero forks, and only 3KB in size. This profile is consistent with a newly deployed dropper or credential harvester stub. Extremely small size suggests a redirect, loader script, or phishing payload rather than a functional bot.

• Suspicious DependencyJun 20, 2026github.com/King102681/polymarket-bot

  No description, large repo size, unknown author

  Repository has no description, zero stars, zero forks, but is 63376KB. This combination of zero community engagement and large unexplained file size is a red flag for hidden malicious payloads. Users should not run code from this repository without thorough independent auditing.

• Suspicious DependencyJun 20, 2026github.com/mariomerinom/polymarket-bot

  No description, large repo size, low credibility account

  Repository has no description, 6 stars, 2 forks, but is 179278KB — the largest in this report by a wide margin. A repository of this size with minimal engagement and no description is highly suspicious and may contain packed binaries, embedded executables, or obfuscated credential-stealing code targeting Polymarket wallet keys or API credentials.

• Suspicious DependencyJun 19, 2026github.com/mariomerinom/polymarket-bot

  Large repo size with no description

  Repository 'mariomerinom/polymarket-bot' is 178999KB (~175 MB) with no description. Such large size for a trading bot may indicate bundled binaries, hidden payloads, or cryptocurrency malware.

• Suspicious DependencyJun 19, 2026github.com/mariomerinom/polymarket-bot

  Extremely large repo size with no description raises supply chain risk

  Repository has an unusually large size of 178999KB (approximately 175MB) with zero description provided. Oversized repos with no documentation are a known vector for bundling malicious binaries, obfuscated scripts, or hidden payloads alongside legitimate-looking trading bot code. Users should not clone or execute code from this repository.

• Suspicious DependencyJun 19, 2026github.com/radioman/polymarket-arbitrage-trading-bot

  Extremely large repo size inconsistent with stated purpose

  Repository claims to be a 'Polymarket arbitrage trading bot' but has a file size of 737439KB (approximately 720MB), which is grossly disproportionate for a trading bot or dashboard tool. This is a strong indicator of bundled binaries, embedded executables, or other hidden payloads that could pose a malware risk.

• Suspicious DependencyJun 18, 2026github.com/kshitij406/polymarket-weather-bot

  Oversized repo with no description

  Repository 'kshitij406/polymarket-weather-bot' is 160009KB (160MB) with 0 stars, no description. Unusually large for a weather prediction bot; may contain bundled executables, malicious scripts, or data exfiltration tools.

• Suspicious DependencyJun 18, 2026github.com/mariomerinom/polymarket-bot

  No-description 175MB repo — likely bundled binaries or data exfiltration payload

  Repository has no description, 6 stars, 2 forks, and is 175377KB (approximately 175MB) in size. A legitimate Polymarket trading bot has no plausible reason to be this large. This size is consistent with bundled compiled executables, packed archives, or large obfuscated scripts. Users who clone and run this repo risk executing unknown binaries that could steal API keys, wallet private keys, or USDC credentials.

• Suspicious DependencyJun 18, 2026github.com/mariomerinom/polymarket-bot

  Suspiciously large binary/blobs in new repo

  Repository 'mariomerinom/polymarket-bot' is 175377KB (175MB) with only 6 stars, created 2026-03-15. Extremely large size for a trading bot repo could indicate packed binaries, obfuscated payloads, or hidden data (e.g., compiled malware, credential dumps, or crypto miners). No description provided to verify legitimacy.

• Suspicious DependencyJun 18, 2026github.com/kshitij406/polymarket-weather-bot

  No-description 160MB weather bot repo — unexplained large size

  Repository has no description and is 160009KB (approximately 156MB) with zero stars and zero forks. Like the mariomerinom repo, there is no legitimate reason for a weather-data Polymarket bot to be this large. The absence of any description combined with the extreme size is a red flag for bundled malicious executables or credential-harvesting payloads.

• Suspicious DependencyJun 18, 2026github.com/benjee-inc/polymarket-arb-dashboard

  Large arbitrage dashboard repo with no public traction — possible credential harvester

  Repository is 19634KB (approximately 19MB) with zero stars and zero forks, created in February but updated to the report date. A dashboard application of nearly 20MB with no community interest is suspicious; legitimate dashboards of this type are typically a few hundred kilobytes. The large size may indicate bundled binaries. Users should not enter API keys or wallet credentials into software from this source without a full code audit.

• Suspicious DependencyJun 17, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Randomly generated username on high-engagement repo — likely malicious actor

  The account 'bit-nexusxtitmtdsuy' hosting 'Polymarket_Bot' has a clearly auto-generated username (common in throwaway malware distribution accounts). The repo has 32 stars and 17 forks with a large size (35535KB). Auto-generated usernames with inflated engagement and large binary-heavy repos are a known malware distribution pattern. The code should be treated as untrusted and not executed without full static and dynamic analysis.

• Suspicious DependencyJun 17, 2026github.com/pmxt-dev/pmxt

  Suspicious dependency / supply chain risk in pmxt-dev/pmxt

  PMXT provides a unified API for multiple prediction markets (Polymarket, Kalshi, etc.) with 1898 stars and 224 forks. Centralized third-party API abstraction layer could be used to inject malicious code or intercept API keys and wallet credentials.

• Suspicious DependencyJun 17, 2026github.com/mbordash/DRADIS

  Suspicious dependency / potential data exfiltration in mbordash/DRADIS

  DRADIS trading bot integrates AI LLM Advisor via Ollama and Telegram, with 'OpenClaw' module. Remote communication channels and AI advice retrieval could be used to exfiltrate trading keys, strategies, or wallet data.

• Suspicious DependencyJun 16, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Polymarket Bot with 32 stars — possible credential theft

  Repository bit-nexusxtitmtdsuy/Polymarket_Bot has 32 stars and 17 forks, unusually high for a new repo (created 2026-03-23) with a generic name. The description mentions interacting with Polymarket via USDC, which suggests wallet/API key handling, making it a potential credential harvesting vector.

• Suspicious DependencyJun 14, 2026github.com/braedonsaunders/homerun

  Homerun platform with AI scoring and copy trading

  braedonsaunders/homerun is 53MB with 92 stars and includes AI scoring, copy trading, and 25+ strategies — large size suggests bundled dependencies that may introduce security risks.

• Suspicious DependencyJun 14, 2026github.com/quipmnxailcrrgky/tradingbot

  Large Polymarket bot repo with suspicious size

  quipmnxailcrrgky/tradingbot has 33MB size, 98 stars, 60 forks, and vague description 'Easy setup and creation of a bot' — suggestive of bundled malware or obfuscated payload.

• Suspicious DependencyJun 14, 2026

  kalliimmunosuppressive504/polymarket-copy-trading-bot — typo-squatting account

  Account name 'kalliimmunosuppressive504' is nonsensical and likely auto-generated. Repo is a copy-trading bot with 'polling' features — may include remote code execution or credential exfiltration via WebSocket.

• Suspicious DependencyJun 14, 2026

  Amoralismelectronictext609/polymarket-copy-trading-bot-clob-ai — whale tracking bot

  Account name is auto-generated and nonsensical. Repo tracks 'whale activity' and uses CLOB AI — could be a honeypot to steal API keys or deploy automated theft of USDC.

• Suspicious DependencyJun 14, 2026

  Philsober337/Todo-Tree-Next — suspicious TypeScript copy trading bot

  Name 'Todo-Tree-Next' is misleading; actually a Polymarket copy trading bot with 'security controls.' Repo size 2,694 KB with no stars. Could contain malicious npm dependencies that execute credential theft on install.

• Suspicious DependencyJun 14, 2026github.com/bit-nexusxtitmtdsuy/Polymarket_Bot

  Large Polymarket bot repo with bundled dependencies

  bit-nexusxtitmtdsuy/Polymarket_Bot is 35MB with 32 stars and 17 forks, likely containing pre-packaged node_modules or binaries that could contain malicious code.