
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
Official PMWallets SDK: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks and exports.
Official Node.js / TypeScript client for PMWallets: the Polymarket smart-money leaderboard computed from the Polygon chain, and the real-time fills of the Polymarket wallets you follow — delivered in order, exactly once, with every gap replayed.
中文说明 · Python SDK: pmwallets-python · Ready-to-run copy-trading bot built on it: polymarket-copy-trading-bot
npm install pmwallets # Node.js ≥ 20
Create an API key on pmwallets.com/keys.
import { PmwClient, FillStream, FileStateStore, verifyWebhook } from 'pmwallets';
const pmw = new PmwClient({ apiKey: process.env.PMW_API_KEY! });
// who is making money on Polymarket, and how
const board = await pmw.leaderboard({ minWinLo: 0.55, minEligible: 30, style: 'taker', status: 'active', limit: 50 });
// follow one (billed per entity per hour; 402 = balance too low, 409 = dormant)
await pmw.subscribe({ entityId: board.rows[0].entityId, channels: ['ws'] });
// every fill of every entity you follow
const stream = new FillStream({
client: pmw,
store: new FileStateStore('./stream.json'), // a restart resumes exactly where it stopped
onFill: async (fill, { source }) => console.log(source, fill.side, fill.price, fill.tokenId),
onEvent: (e) => e.type === 'fatal' && console.error(e.error.message), // e.g. another bot already holds the stream
// takeover: true, // replace whichever API client holds this account's stream (it stops with `replaced`)
});
await stream.start();
PmwClient | leaderboard, entities, address unlocks, your unlocked addresses (myAddresses), subscriptions, fills replay (fills, fillsSince), trade-history exports |
FillStream | WebSocket with reconnect and keep-alive; detects missed frames by session/seq and replays them from the last fill delivered; de-duplicates by eventId; anchors behind the chain head on first start; persisted cursor |
verifyWebhook(rawBody, signature, secret) | checks x-pmw-signature (HMAC-SHA256 of the raw body) |
One stream per account:
blocked, then fatal, and the stream stops. Pass takeover: true to replace the holder instead; the holder gets replaced, then fatal, and stops (it does not fight back).FillStream identifies itself with a random clientId, so its own reconnects after a network drop replace its own dead connection without needing takeover.1012; the stream reconnects at once (event restarting) and replays anything it missed.
HTTPS_PROXY: pass wsOptions: { agent } for the WebSocket and set a global fetch dispatcher.PMWallets' servers are in the United Kingdom. A consumer that also trades on Polymarket should run from Ireland (AWS eu-west-1): Polymarket does not accept API orders from the UK, the US and several EU countries.
A purchase is access to files: one zstd-compressed CSV per wallet per UTC day, downloadable at once and again later.
const order = await client.createExport({ entityIds: ['0x…'], from: '2026-09-01', to: '2026-09-30' });
const { files } = await client.exportFiles(String(order.id));
for (const f of files) {
const bytes = await client.downloadExportFile(f.wallet, f.day); // .csv.zst
}
exportFileUrl(wallet, day) returns the short-lived link instead; the API key is never sent to the storage host.
MIT
FAQs
Official PMWallets SDK and CLI: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks, exports — and a CLI + MCP server so AI agents (Claude Code, Codex, Cursor, …) can follow traders and act on their fills.
The npm package pmwallets receives a total of 73 weekly downloads. As such, pmwallets popularity was classified as not popular.
We found that pmwallets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.