Malware clones surface; 7 bots worth running today
Two identical 460KB malware repos appeared in the wild today alongside a coordinated star-inflation spam campaign — operators should audit their clone sources before running anything new. On the upside, seven legitimate bots are worth cloning, headlined by cross-platform arb between Polymarket and Kalshi and a weather-edge model with a clean Gaussian probability core.
Two Malware Clones, Seven Legitimate Bots: Today's Full Rundown
The headline today is defensive: two repos carrying an exact 460KB clone fingerprint malware template surfaced within the same scan window, accompanied by a garbled-username star-inflation campaign designed to push fraudulent repos up visibility rankings. If you cloned anything Polymarket-adjacent in the last 24 hours, verify it now. Details in the security section below.
On the opportunity side, this was a strong day for new tooling — seven repos cleared our threshold for cloning, spanning weather arbitrage, cross-market arb, and AI agent infrastructure.
---
New Bots: What's Worth Running
**Auramaur** is the lead find today. It implements autonomous cross-platform arbitrage between Polymarket and Kalshi, which means it's targeting genuine price discrepancies across two liquid venues with overlapping market sets. With Spain now blocking both platforms and regulatory pressure fragmenting liquidity geographically, cross-platform spread opportunities are likely to widen in the near term. This is a high-priority clone.
**arbiter** takes a more focused approach: it hunts no-arbitrage violations across *related* election markets within Polymarket itself — think correlated candidates, conditional outcomes, and bracket markets that must satisfy internal consistency constraints. It uses fractional Kelly for position sizing, which is the right call for this kind of correlated exposure. Solid implementation discipline.
**polymarket-weather-edge** applies a Gaussian probability model to temperature markets and bets NO when the market price exceeds the modeled outcome probability. The edge here is straightforward: weather markets on Polymarket are thin and retail-driven, and a calibrated statistical model should find consistent mispricing. Worth benchmarking against historical resolution data before deploying capital.
**polymarket-mcp-server** is infrastructure rather than a trading bot — it exposes Polymarket data to AI agents via the Model Context Protocol, enabling real-time monitoring and market analysis. If you're building agent-based systems, this is the scaffolding layer you'd otherwise write yourself.
**winning-wallet-finder** is flagged *monitor* rather than clone. It uses z-scores to identify statistically profitable wallets for copy-trading signals. The methodology is sound in principle, but copy-trading on Polymarket suffers from latency and position-size constraints that erode edge quickly. Watch the repo for maturity before committing.
---
Security: Malware and Spam Alerts — Read This
Three alerts require immediate attention:
1. **Exact 460KB clone fingerprint malware template** — a repo engineered to look like a legitimate Polymarket bot, with a file size and structure fingerprint that matches a known malware template. **Do not run.** 2. **Second instance of the same 460KB template** — a separate repo, same fingerprint. This is a coordinated distribution, not a one-off. Assume there may be additional copies not yet flagged. 3. **Garbled username star-inflation campaign** — fake accounts inflating star counts on suspect repos to manufacture social proof. If a repo appeared to gain stars rapidly overnight, treat that as a red flag, not a green light.
Practical rule: always inspect the full dependency tree and run in an isolated environment before touching any new Polymarket repo. The 460KB fingerprint specifically — if you see an unusually uniform archive size matching that figure, do not execute.
---
Alpha Signals: Research Worth Reading
Three research papers flagged today, no live trade signals.
The most actionable for operators: a paper proposing an **agentic AI pipeline that clusters prediction markets into topical groups and surfaces implicit contradictions across markets**. This is directly applicable to the *arbiter*-style internal arb strategy — automating the identification of consistency violations at scale rather than hand-coding market relationships.
Also notable: a **path-signature framework for optimal execution of stat-arb strategies**, modeling alpha and trading speed as linear functionals of truncated path signatures. Technically dense but relevant if you're scaling execution on correlated markets.
---
What to Watch
Spain's regulatory block on both Polymarket and Kalshi is the macro story. Liquidity fragmentation across jurisdictions creates structural arb opportunities — Auramaur is positioned for exactly this. Monitor whether other EU regulators follow Spain's move. The HN thread on Polymarket operators threatening journalists over the Iran missile market is worth reading for sentiment; it signals how much real money is now moving on geopolitical markets and the social pressure that creates. The "Nothing Ever Happens" NO-bias bot hitting 471 points on HN is a useful reminder that the base rate on non-sports markets strongly favors NO — any new market without strong informational catalysts deserves a prior in that direction.