460KB Malware Campaign Targets Polymarket Bot Builders
A coordinated malware campaign is distributing identical 460KB clone repos across GitHub, targeting Polymarket bot builders who pull untrusted code. Separately, two research papers formalize arbitrage limits in Polymarket's negative-risk and multi-outcome markets — useful reading before you build your next arb strategy.
460KB Malware Campaign Is the Story Today
If you cloned anything Polymarket-related from GitHub in the last 48 hours, stop and audit your environment now. Intelligence from today's scan confirms an active, coordinated campaign distributing malicious bot templates across at least two repositories. Both share an exact 460KB fingerprint — a reliable indicator these are stamped from the same malware template rather than coincidental forks. This is a campaign, not a one-off. The attack surface is obvious: bot builders are conditioned to clone, install dependencies, and run. That's the entire threat model here.
**What to do:** Cross-reference any recently cloned Polymarket repos against known-good sources. Do not run `npm install` or `pip install` on anything you can't fully audit. Check for obfuscated scripts in `postinstall` hooks, `.env` harvesters, and outbound network calls at startup. The 460KB size is your canary — flag any repo hitting that exact weight.
---
New Bots Scanned: 8 Found, 3 Worth Your Time
**Worth cloning:**
- **polymarket-weather-edge** — The most interesting find this week. Runs statistical arbitrage against NOAA forecast data, systematically fading overpriced YES positions on weather-linked markets. The core insight is that retail money misprices temperature tail events. If you have any NOAA API experience, this is a genuine edge worth extracting and adapting. Verdict: clone and study the signal logic.
- **polymarket-copy-trader** — Copy-trading framework focused specifically on delay and slippage measurement against top-performing wallets. What separates this from generic copy-trade scripts is the PnL attribution work — it isolates how much of a whale's edge bleeds out by the time you execute. Useful both as a live tool and as a research instrument for understanding copy-trade viability on Polymarket's liquidity profile.
**Monitor:**
- **TG-Polymarket-bot** — Whale copy-trading via on-chain and order flow signals piped through Telegram. The architecture is sound but the signal quality depends entirely on which wallets it's tracking. Worth watching for updates; not ready to clone blind.
**Skip:**
- **polymarketfuturesbot** — Scalping US Futures price movements into Polymarket. The correlation logic doesn't hold up under scrutiny for most markets. Pass.
- **Polymarket_Bot** — Generic API integration toolkit, no alpha strategy. Fine for onboarding, useless for edge.
---
Alpha Signals: Two Research Papers Worth Reading
No live executable trades in today's scan, but two academic signals with real operational implications.
**Paper 1 — Negative-risk arbitrage limits:** This paper draws a hard line between theoretical no-arbitrage conditions and what's actually executable on-chain before settlement. The finding that matters: price violations in Polymarket's negative-risk markets exist but are often not capturable before resolution. If you've been running negative-risk arb strategies assuming you can always close the loop, this paper may explain your unexplained slippage and timing losses. Read it before building further.
**Paper 2 — Exhaustive/mutually exclusive resolution conditions:** Formalizes how violations of proper set structure in multi-outcome markets create exploitable mispricings. If Polymarket's conditions are not truly exhaustive and mutually exclusive, the math produces arb. This is a framework paper — it gives you a checklist to run against any multi-outcome market before you size in.
---
Strategy Intelligence
The HN viral item — *Nothing Ever Happens*, a bot that blanket-buys NO on non-sports markets — hit 471 points. Ignore the meme framing. The underlying observation is real: non-sports event markets on Polymarket resolve NO at a rate that retail consistently underweights. The weather-edge bot above is essentially a disciplined version of the same instinct.
Spain's regulatory block on Polymarket and Kalshi is worth tracking for geographic exposure in your wallet activity. If you're routing through Spanish IPs or serving Spanish users, model that jurisdiction risk now.
---
What to Watch
- Any new repos appearing at exactly 460KB. The campaign is active and will likely rotate repo names.
- Follow-up disclosure on which wallets **TG-Polymarket-bot** is actually tracking — that determines whether it's signal or noise.
- The negative-risk arb paper's reception among quant traders. If it gains traction, expect the remaining exploitable violations to close faster.