We audited the top 50 'polymarket bot' repos on GitHub: six deliver malware, and 7 of the first 10 fail basic checks

The short answer

Search GitHub for "polymarket bot" and you get 4,030 results. We took the first 50, in the default "best match" order a visitor sees, and went through each one as if we were about to run it with real money: the code, the commit history, the forks, every dependency and every release. We ran none of it.

• Six repos deliver malware. One installs a fake Polymarket client from a lookalike registry. One installs a typosquat that steals your .env file. Two have cycled through a family of malicious npm loggers. One hides an in-memory Windows loader. One ships a 100 MB .exe.
• Ten more fake it. They manufacture popularity with fork farms or commit spam, borrow stars from a renamed older project, or contain no code at all and sell the "full version" over Telegram.
• Seven of the first ten results fall into one of those groups.
• The other 34 show no red flag, and that includes the real projects. Twenty of those 34 have no license, though, so legally you may read the code but not reuse it.

What we checked

For each of the 50 repositories we went through four things.

Code. We downloaded every source and config file as plain text and searched it for five things:

• hard-coded hosts outside the usual Polymarket, RPC, exchange and AI endpoints;
• long base64 or hex strings, and eval or exec of decoded data;
• install hooks;
• code that sends keys over the network;
• Windows API calls in projects that have no reason to make them.

Dependencies. We checked every npm and PyPI package named in a manifest, including names that were added and later removed in the commit history. Each one went through the registries and through OSV, the open database where Amazon Inspector, GitHub and independent researchers file malicious packages under MAL- IDs.

History and forks. GitHub no longer shows who starred a repository, so forks are the visible trail. We looked at:

• commit counts and messages, and the dates of the first commits;
• the age of the owner's account;
• up to 400 forks per repository: when they were made and whether they were renamed;
• for a sample of 20 forks, the age of the account behind each one, and whether it still exists.

Releases. We listed every release asset. Where a release was a prebuilt archive, we listed its contents and read its scripts as text, without unpacking or running anything.

Finding 1: six repos deliver malware

The fake Polymarket client (rank 6)

Polymarket's official TypeScript client is published on npm as @polymarket/clob-client-v2. This repository presents itself as that client, and its README tells you to install @polymarkets/clob-client-v2, with one extra letter.

• The package. Versions 1.0.0 to 1.0.5, published in May, carried no extra dependency. Version 1.0.6, published August 8, added one fetched from registrynpmjs.to, a lookalike of npm's own registry.npmjs.org. Whoever runs that host decides what code lands in your node_modules.
• The record. OSV lists the package as malicious under MAL-2026-14050, filed August 14. On October 16 it was still the latest version on npm, with 275 downloads in the previous 30 days.
• The repository. Its forks are named lighthouse-router, so it started life as a different project and was renamed. The account that owns it was created on January 19, 2026.

The source on GitHub is clean; the payload exists only in what npm installs. Reading the GitHub code is not enough when the README sends you to npm.

The .exe and the downloader (rank 9)

The repository began in 2022 as a small website project; the first commits are titled "first commit formation" and "ajout product". On August 26, 2026, a single commit titled "Replace Mito site with Abrownfox001 trading bot" changed three things:

• it added a 100 MB Abrownfox001.exe, which the README tells you to "download and run";
• it added a dependency on twapfetch;
• it added links to Telegram.

OSV had already listed twapfetch as malicious a week earlier (MAL-2026-14197). The record describes a postinstall script that downloads a tarball from an address it reads from environment variables or the package's homepage field. The repo removed the dependency on September 10; the .exe is still there.

Of its 381 forks, 377 were created on August 26. All 20 fork owners we sampled had opened their accounts less than a month before.

The .env stealer (rank 13)

Its requirements.txt lists py-clob-clients, a typosquat of Polymarket's official py-clob-client. The OSV record (MAL-2026-3220) says the package "exfiltrates env variables from .env files" and cites this very repository. For a trading bot, the .env file is where the private key lives.

PyPI has removed the package, but the line is still in the repo. The repository itself started out as something else: its forks are named Crypto-Casino-Crash-Game.

The logger rotation (ranks 16 and 45)

Two repositories cycled through malicious npm packages dressed up as loggers.

MoonsatProtocol used four in three weeks, and the first two were swapped out within days of being flagged:

1. changelog-logger-wrap, added March 18 and listed as malicious March 19;
2. changelog-utils-wrapper, added March 20 and listed March 25;
3. changelog-utils-structured-logger, added March 27;
4. terminal-pretty-logger, added April 7 and listed June 16. It is still in package.json.

BizShibe added pretty-changelog-logger on February 27. Two days after it was listed on March 16, the repo replaced it with logger-beauty, which is still there.

ReversingLabs ties these package names to a campaign it calls PromptMink. According to their research, the packages collect .env files, JSON files and files with crypto-related names, send them out, and add an attacker's SSH key for persistent access. The advisory for logger-beauty puts it bluntly: treat any machine that installed it as fully compromised.

The same research notes that the campaign targets AI coding agents, so an owner may have been fooled rather than complicit. For anyone who installs the repository, the result is the same.

The in-memory loader (rank 21)

This one has no OSV record, so the evidence is ours. The repository was created on October 12. It carries a support/ package, and the same package sits in a 14 MB release zip that had been downloaded 248 times by October 16.

Read as text, the package does the following:

• It decodes a hex string, stored backwards, into api.failproxy.space.
• It calls /api/v1/auth/session and /api/v1/data/sync on that host. If the name does not resolve, it falls back to two hard-coded Cloudflare addresses.
• It decrypts what comes back with AES-GCM.
• It hands the result to a loader that maps a Windows executable into memory with VirtualAlloc, GetProcAddress and CreateThread.

A launcher script unpacks a bundled python.exe from an opaque 14 MB file to run all of this, while the visible bot runs on a module called mock_data. Of the repo's 26 forks, 21 appeared on October 14, and all 20 fork owners we sampled were brand-new accounts with no followers.

Finding 2: the popularity is manufactured

Malware is half of it. The other half is making a repository look busy and trusted enough to rank:

• Commit spam. Cleverfuxaqo1668/Polymarket-Telegram-Bot (rank 4) and dunefalcon1qrj/Telegram-Bot (rank 15) are the same three files: a README, a LICENSE and a 2 KB script. One has 64,076 commits that add and remove the LICENSE file, about once a minute. The other has 53,753 commits titled "Update LICENSE". Their forks arrived in a single day from accounts a few weeks old, and both READMEs point to the same Telegram bot.
• Fork farms. thesoulcrancerdev/poly-trading-strategies (rank 12) was forked by accounts called polylayer-1, polylayer-2, polylayer-3 and so on, and every fork was renamed fx-0000-d4377b7a. The farmed forks of abrownfox0 (rank 9) are named fn-0000-d4377b7a. Same hash, same operator.
• Borrowed stars. radioman/polymarket-arbitrage-trading-bot (rank 1, 528 stars) was created in 2016 as WebRtc.NET, a WebRTC library. Its forks still carry that name and its tree still holds the WebRTC DLLs. The bot may run, but its stars belong to something else. HarrierOnChain/Prediction-Markets-Trading-Bot-Toolkits (rank 8, 495 stars) began as Solana-Pumpfun-Smart-Contract.
• Ghost forks. For HarrierOnChain, 16 of 20 sampled fork owners no longer exist; for Poly-Dev05/polymarket-trading-bot (rank 3), 17 of 20. GitHub removes spam accounts, and the forks they made stay behind. Poly-Dev05's repository is also older than the account that owns it, so it was moved from another account.

Finding 3: three are empty shells selling over Telegram

• Nour-Br/polymarket-crypto-5m-15min-trading-bot (rank 7) contains one file, a README. It quotes a leaderboard profit figure and a Telegram handle. The repository dates from 2022, and all 25 forks were made by a single account on October 1.
• 0xalberto/polymarket-arbitrage-bot (rank 30) is also only a README: "$500-700/day from $200 deposit", followed by "contact me on telegram" to buy.
• thesoulcrancerdev/poly-trading-strategies (rank 12) has strategy write-ups, no code, and the farmed forks above.

Finding 4: what the rest look like

34 of the 50 show none of these signals. That does not mean they work: we read them, we did not trade with them. It does mean the obvious ways a repository can hurt you were not there.

The serious ones stand out, with real commit histories and licenses:

• CloddsBot: 2,975 stars, 463 commits, MIT;
• poly-maker: 1,512 stars, MIT;
• PolyWeather: 2,288 commits, AGPL-3.0;
• Chainstack's polymarket-alpha-bot: Apache-2.0;
• Octagon's kalshi-trading-bot-cli: MIT.

The three of the 50 that are listed in our catalog are CloddsBot, poly-maker and the BTC 15-minute bot, and all three came through clean.

Twenty of the 34 publish no license at all. Without one, the code is all rights reserved, whatever the README says. Several also commit compiled .pyc files next to their source; those are harmless only if they match the source, and nobody checks that.

What we are not saying

• We are not saying every owner of a flagged repository is an attacker. The PromptMink packages target AI coding agents, and a developer can be fooled. The verdict is about what the repository does to whoever installs it.
• We did not run anything. Every finding comes from reading code, manifests, commit history and registry records. The one release archive we opened, we only listed and read as text. For five of the six malware verdicts, an independent OSV record backs the call. For the in-memory loader, the evidence is the code itself, quoted above.
• "No red flag" is not an endorsement. We could not test whether the 34 make money, and a clean repository can turn malicious with its next commit.
• Search results move daily. Another day's top 50 will differ. The patterns won't.

If you own one of the repositories above and we have something wrong, tell us, and we will publish the correction.

Before you run a Polymarket bot from GitHub

1. Check every dependency against OSV, including old ones. Paste the package names into osv.dev, or query it from the command line. MAL- in the result means malicious:

curl -s -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"PACKAGE_NAME","ecosystem":"npm"}}'

1. Compare names letter by letter. Polymarket's official packages are @polymarket/clob-client-v2 on npm and py-clob-client on PyPI. @polymarkets and py-clob-clients are not them.
2. Read package.json for URLs. A dependency whose version is an https:// address installs whatever that host serves. So does a postinstall script that downloads anything.
3. Treat any binary as hostile. That includes a .exe in the tree, a "download the release" instruction, a zip that is far larger than the source, or a bundled python.exe.
4. Search the code for disguised strings and Windows calls. Hex or base64 strings that decode to URLs, [::-1], VirtualAlloc or CreateThread have no business in a Python trading bot.
5. Look at the forks, not the stars. Many forks on a single day, renamed to hashes, or owned by accounts that no longer exist, mean bought popularity.
6. Never use a funded key for a first run. Run new code against a fresh wallet holding a few dollars, ideally in a container or a VM; our guide to wallets and keys covers the setup.

Indicators

For defenders and anyone checking a lockfile:

• npm: @polymarkets/clob-client-v2 1.0.6, twapfetch, changelog-logger-wrap, changelog-utils-wrapper, changelog-utils-structured-logger, terminal-pretty-logger, pretty-changelog-logger, logger-beauty
• PyPI: py-clob-clients
• Hosts: registrynpmjs.to, api.failproxy.space
• Release archive SHA-256 (semrincaballero, Oct 12, 2026): ccaecf6418a3f232dfde9f2bdff55c9bdfa2e9e64f565bd302bc07143f02f568

CloddsBot

Crypto Markets

Open-source AI trading agent that runs on your own machine and takes orders in natural language over Telegram, Discord, WebChat and eighteen other channels. Powered by Claude, it covers ten prediction markets — Polymarket, Kalshi, Betfair, Smarkets, Drift, Manifold, Metaculus, PredictIt, Opinion.xyz and Predict.fun — plus perpetual-futures exchanges and Solana and EVM DeFi. The Polymarket layer is real code rather than a wrapper: an EIP-712 order signer with unit tests, a CLOB client exposing 60-plus methods, real-time data and user WebSocket feeds, a large-trade tracker, and round-based discovery of the 5-minute BTC and the 15-minute, hourly, 4-hour and daily crypto windows with four automated strategies, alongside cross-venue arbitrage detection, copy trading and DCA bots. MIT-licensed at github.com/alsk1992/CloddsBot: 2,700 stars, 460-plus commits from one primary author, v1.9.1 released Sep 12, 2026, installed with one npm command on Node 22.

Botfree · MIT

Poly-Maker

Open source · GitHub

Poly-Maker

Market Making

Open-source market-making bot for Polymarket. Quotes both sides of the book over WebSockets with configurable spreads, position merging and risk controls. Shared by its author as a reference implementation, not a turnkey money-maker.

Botopen-source

BTC 15-Min Bot

Open source · GitHub

BTC 15-Min Bot

Crypto Markets

Open-source Python bot for Polymarket's 15-minute Bitcoin up/down markets. A 7-phase engine fuses spike detection, Fear & Greed sentiment and cross-exchange divergence via weighted voting. Runs live or in paper mode with Grafana dashboards.

Botopen-source