Creative Tim dashboard repositories carried PolinRider loaders

Developers borrowing Creative Tim's dashboard starters could also inherit concealed malware from their source trees. SafeDep's September 30 investigation found PolinRider loaders in four repositories under the established creativetimofficial organization: Black Dashboard Django, Material Dashboard Django, and the Django and Flask editions of Argon Dashboard. These were upstream project checkouts, not merely an unmerged contribution proposing a malicious change.

The templates combined Python web applications with browser assets and JavaScript build tools. Their retained READMEs described features such as authentication, database setup, and CSS compilation, placing those assets alongside the code developers would customize for a new site. The preserved Black and Material snapshots contained large obfuscated additions in postcss.config.js. The Argon snapshots contained injected code in the vendored bootstrap-datetimepicker.js file. Each location concealed executable material in a file with an existing development or interface role.

SafeDep traced the loader family through a server-discovery mechanism using Ethereum transactions: transaction data identified infrastructure from which later stages could be retrieved. Its analysis connected that chain to Node.js and Python credential-stealing components. The compromised files established distributed loaders, but their filenames alone did not establish that every browser visitor or every Python application startup would execute them. The PostCSS path, in particular, exposed tooling that loaded the configuration during asset processing.

The four captured commits preserved the repository states identified by the investigation. September 30 was the date SafeDep confirmed the infected branch tips, not a demonstrated common date of initial access. No original compromise method, confirmed victim total, or complete remediation was established for this organization. The group's inclusion here rested on malicious files in its actual upstream repositories; the separate, rejected oxc pull request that helped lead researchers to the campaign did not meet that distribution boundary.