Malware payload hidden in oversized repo; 3 arb bots worth cloning
A repo flagged today conceals its true size — a known indicator of embedded data-theft payloads — making it the most urgent security finding of the week. Alongside that warning, five new bots surfaced worth serious attention, led by DRADIS's multi-strategy LLM-assisted architecture and two distinct arbitrage plays targeting cross-book and cross-exchange inefficiencies.
Concealed Repo Size Flags Probable Data-Theft Payload
The lead story today isn't a bot — it's a warning. One of eight repos flagged in today's security sweep is exhibiting a well-documented malware delivery pattern: artificially suppressed repo size metadata, used to obscure a large embedded payload from casual inspection. This technique has appeared in prior crypto trading tool attacks where the actual executable or script contains credential scrapers targeting wallet keys, API secrets, or browser session data. **Do not clone, fork, or run any code from this repo.** If you've interacted with it in the past 72 hours, rotate all API keys and check wallet approvals immediately. Full repo identifier is withheld from the free tier — subscribers see the flagged URL in the security annex.
Separately, star-farming was confirmed on at least two Telegram bot clones circulating in Polymarket communities. Inflated star counts are being used to manufacture legitimacy. Neither repo contains confirmed malware, but both are considered unvetted and should be treated as suspect until audited.
---
New Bots: 5 Worth Your Time
**DRADIS** is the most architecturally interesting repo this week. It runs four concurrent strategy modes — momentum, market-making, arbitrage, and ML-based — and integrates an LLM advisor via Ollama and MCP/OpenClaw for real-time optimization suggestions. The AI layer appears to function as a parameter tuner rather than a signal generator, which is a more defensible use of LLMs in a live trading context. Worth cloning and running in paper mode before touching real capital; the multi-strategy complexity means failure modes aren't obvious.
**arbitrage-radar-odds** does one thing: scans Polymarket for mispriced markets and optionally cross-references proxy odds from external books to flag cross-book opportunities. Lean codebase, clear scope. Good starting point for operators building their own arb layer.
**samuel483/poly-kalshi-arb** is the most operationally specific bot this week — purpose-built for Polymarket/Kalshi spread capture with explicit handling for exchange fees and position risk. Kalshi's regulatory expansion makes cross-exchange arb increasingly viable. Fee-awareness baked into the logic is a meaningful differentiator over naive spread scanners.
**polymarket-coherence** takes a research-tool approach: it checks multi-outcome markets for coherence violations — cases where the sum of outcome prices deviates from 1.00 in ways that imply riskless profit. Less a trading bot, more an opportunity validator. Useful for operators who want to verify signals before committing capital.
**POLYMARKET-AI-TRADING-BOT** is flagged for monitoring only. Claims AI-driven arbitrage, copy trading, and market-making, but the implementation hasn't been independently verified and the repo shows patterns consistent with the star-farming clusters flagged in today's alerts. Do not deploy without a full code audit.
---
Alpha Signals: Research Paper Cluster
Three academic papers surfaced today with direct operational relevance.
The most actionable: a paper distinguishing *payoff-space* no-arbitrage (theoretically guaranteed) from *protocol-executable* no-arbitrage (dependent on what position transformations the exchange actually permits). The implication for Polymarket operators is concrete — negative-risk markets create observable violations that may not be exploitable before settlement due to structural constraints. Understanding which arb signals are actually tradeable versus theoretically valid is the difference between profit and slippage.
A second paper formalizes the probabilistic structure of multi-condition Polymarket markets, providing a framework for detecting pricing inconsistencies across linked outcome sets. Directly relevant to anyone running coherence-based strategies.
The third covers LLM-based merger arbitrage forecasting over long technical documents. Less immediately applicable to Polymarket's typical market slate, but the context-engineering methodology is worth studying for anyone building AI-assisted research pipelines.
---
What to Watch
Spain's regulatory block on Polymarket and Kalshi is the macro story with the longest tail. If EU-adjacent enforcement expands, cross-exchange arb infrastructure becomes both more valuable and more legally complex. The HN thread on Polymarket gamblers threatening journalists over the Iran missile market is a reminder of how quickly resolution disputes generate reputational and operational risk. Monitor open positions in geopolitical markets with contested resolution criteria closely over the next 48 hours.