
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Official PMWallets SDK: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks and exports.
Official Node.js / TypeScript client for PMWallets: the Polymarket smart-money leaderboard computed from the Polygon chain, and the real-time fills of the Polymarket wallets you follow — delivered in order, exactly once, with every gap replayed.
中文说明 · Python SDK: pmwallets-python · Ready-to-run copy-trading bot built on it: polymarket-copy-trading-bot
npm install pmwallets # Node.js ≥ 20
Create an API key on pmwallets.com/keys.
import { PmwClient, FillStream, FileStateStore, verifyWebhook } from 'pmwallets';
const pmw = new PmwClient({ apiKey: process.env.PMW_API_KEY! });
// who is making money on Polymarket, and how
const board = await pmw.leaderboard({ minWinLo: 0.55, minEligible: 30, style: 'taker', status: 'active', limit: 50 });
// only wallets whose address unlocks for free or for the $1 band (0 = free … 5; the ladder is board.pricing.bands)
const cheap = await pmw.leaderboard({ bands: [0, 1], minWinLo: 0.55 });
// follow one (billed per entity per hour; 402 = balance too low, 409 = dormant)
await pmw.subscribe({ entityId: board.rows[0].entityId, channels: ['ws'] });
// every fill of every entity you follow
const stream = new FillStream({
client: pmw,
store: new FileStateStore('./stream.json'), // a restart resumes exactly where it stopped
onFill: async (fill, { source }) => console.log(source, fill.side, fill.price, fill.tokenId),
onEvent: (e) => e.type === 'fatal' && console.error(e.error.message), // e.g. another bot already holds the stream
// takeover: true, // replace whichever API client holds this account's stream (it stops with `replaced`)
});
await stream.start();
PmwClient | leaderboard, entities, address unlocks (balance or plan), your unlocked addresses (myAddresses), plan and balance, subscriptions, webhook status and deliveries, fills replay (fills, fillsSince), trade-history exports |
FillStream | WebSocket with reconnect and keep-alive; detects missed frames by session/seq and replays them from the last fill delivered; de-duplicates by eventId; anchors behind the chain head on first start; persisted cursor |
verifyWebhook(rawBody, signature, secret) | checks x-pmw-signature (HMAC-SHA256 of the raw body) |
One stream per account:
blocked, then fatal, and the stream stops. Pass takeover: true to replace the holder instead; the holder gets replaced, then fatal, and stops (it does not fight back).FillStream identifies itself with a random clientId, so its own reconnects after a network drop replace its own dead connection without needing takeover.1012; the stream reconnects at once (event restarting) and replays anything it missed.
HTTPS_PROXY: pass wsOptions: { agent } for the WebSocket and set a global fetch dispatcher.PMWallets' servers are in the United Kingdom. A consumer that also trades on Polymarket should run from Ireland (AWS eu-west-1): Polymarket does not accept API orders from the UK, the US and several EU countries.
A purchase is access to files: one zstd-compressed CSV per wallet per UTC day, downloadable at once and again later.
const order = await client.createExport({ entityIds: ['0x…'], from: '2026-09-01', to: '2026-09-30' });
const { files } = await client.exportFiles(String(order.id));
for (const f of files) {
const bytes = await client.downloadExportFile(f.wallet, f.day); // .csv.zst
}
exportFileUrl(wallet, day) returns the short-lived link instead; the API key is never sent to the storage host.
Guides
MIT
FAQs
Official PMWallets SDK and CLI: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks, exports — and a CLI + MCP server so AI agents (Claude Code, Codex, Cursor, …) can follow traders and act on their fills.
The npm package pmwallets receives a total of 0 weekly downloads. As such, pmwallets popularity was classified as not popular.
We found that pmwallets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.