The public repository is a product page, not the bot
The README describes a Telegram service called Whale Alerts. It says the service watches Polymarket trades, sends personal alerts, places a bet after one tap, mirrors chosen traders, shows live sports and prices, and maintains a wallet linked to the user's Polymarket account. That would be a substantial trading application with custody, signing, market data, Telegram handlers, user settings, and transaction history. None of that implementation is in this repository.
commit 0f0ffa8 has a README, an MIT license, and 1 JavaScript file named live-feed-example.js. The README itself says the example is not the actual bot and omits its business logic, filters, and Telegram integration. It also links to demo/live-feed-example.js, while the checked-out file is at the repository root. A developer cannot clone this project and reproduce the screenshots or hosted service.
The example filters large buys and prints them to a console
The code connects to Polymarket's live-data WebSocket, subscribes to the activity topic with the orders_matched type, and ignores messages without a payload. It keeps only buy-side trades, multiplies size by price, and prints those worth at least $50,000. A 15-second ping interval detects a connection that stops responding, and a closed socket triggers another connection attempt after 5 seconds.
That is useful as a compact feed sketch. It does not import a Telegram library or send a message. There is no market search, sports view, order construction, signature, copy-trading rule, account record, PIN screen, encryption function, balance transfer, or trade-history store. Even the ws dependency has no package.json entry because no manifest is published. Readers must separate what the 1,674-byte example demonstrates from what the hosted product claims.
What happened when we ran it
The lab marked this checkout NOT RUN on August 26, 2026. Its language is JavaScript, which was not a supported ecosystem for this sandbox job, and the repository had no Dockerfile that could provide another supported route. Consequently there are no measured install, build, dependency, test, timing, or vulnerability results for this project.
Our sandbox allocation was 3 CPUs and 8 GB of RAM, but no application was executed. The absence of a package manifest would remain a practical blocker for a normal clone: the example calls require('ws') without declaring a version or install command. We cannot report whether the live endpoint accepted the sample, whether reconnecting worked, or whether any Telegram or trading behavior functioned.
Server-held wallet material is the adoption decision
The README says a user's private key and seed phrase are encrypted and stored on the bot operator's server, tied to an account and protected by a PIN. It also says one tap signs and submits a bet without a wallet confirmation popup. Those statements describe a custody model in which the service must gain access to signing material after the user supplies the PIN. Convenience comes from removing the separate confirmation the official interface would show.
No public code here lets a reviewer inspect the cipher, key derivation, PIN attempt limits, server logging, backup policy, administrator access, withdrawal validation, or incident response. The terms are said to live inside the Telegram bot rather than in the repository. A competent user should read those terms before connecting funds, then decide how much loss the service could cause if the Telegram account, PIN, server, or operator were compromised.
Copy trading adds execution risk that the example does not cover
Mirroring a trader sounds simple until price movement, partial fills, market closure, allowance state, and budget limits enter the path. The README says users can copy with a set budget, fixed amount, or multiplier, but it does not publish the code that resolves those cases. The WebSocket sample only observes matched buys and prints a line. It neither submits an order nor proves that an alert arrives before a copied price changes.
The public channel threshold is described as $100,000, while the sample's console threshold is $50,000. That is not necessarily a defect because the file is explicitly a demonstration. It does show why the example cannot verify product settings. Any evaluation of execution quality, missed events, fill prices, or account reconciliation would need access to the running service and its records, none of which our repository review had.
A same-day push is activity, not a track record
GitHub says the repository was created and last pushed on August 26, 2026. It had 125 stars, no combined open issues or pull requests, and no latest release when fetched. A zero count on a repository this new says little about support quality. There has not been enough public issue or release history to judge how the operator handles a trading outage or a wallet bug.
The project is candid in one important place: it labels the code as a feed example rather than pretending to publish the bot. Our judgment follows that boundary. The 1-file sample may help someone understand Polymarket's activity stream, but it is not an installable open-source trading product. Evaluate the hosted bot as a third-party custodial service, with the private implementation and short public history that choice entails.