Get-Shit-Done creator rug-pulls $GSD token, vanishes
Key insights
- The get-shit-done creator deleted all social accounts and drained $GSD token value before abandoning the project entirely.
- The community forked the project to get-shit-done-redux and completed a security audit; original npm packages remain live on the registry.
- This incident is classified as single-developer exit fraud, not a malware injection or supply chain worm campaign.
Why this matters
AI tools increasingly bundle crypto tokens as a monetization layer, creating a financial incentive structure that makes rug pulls a repeatable threat vector aimed directly at developer communities. The abandoned npm packages from this incident remain live on the registry, meaning every developer who installed get-shit-done faces ongoing supply chain exposure until npm administrators or the community forces their removal. Exit fraud by open-source maintainers is structurally harder to detect than malware injection because the tool itself may be fully legitimate until the moment the creator decides to leave.
Summary
The creator of get-shit-done, a Claude-based AI coding tool paired with a $GSD crypto token, executed a rug pull, drained the token's value, deleted all social accounts, and vanished.
The community forked the project to get-shit-done-redux on GitHub, completed a security audit, and is urging immediate removal of the original npm packages, which remain live on the registry with no active maintainer.
Essentially: (anonymous solo developer, npm registry) a credible open-source AI tool doubled as a crypto exit scam.
- The $GSD token was the financial hook; the creator held enough supply to drain value before disappearing.
- Original npm packages are still published and accessible, a standing risk until registry administrators act.
- Community forensics classify this as single-developer exit fraud, distinct from malware injection attacks like Shai-Hulud.
Abandoned packages from a compromised author sitting live on a major registry represent a supply chain risk that outlasts the rug pull itself.
Potential risks and opportunities
Risks
- Abandoned get-shit-done npm packages could be claimed by a third party and weaponized as a supply chain vector targeting the existing install base before npm acts
- Developers who integrated get-shit-done into CI/CD pipelines face ongoing exposure if the packages are not audited and purged before a new actor claims the namespace
- The $GSD token, if still tradeable on any exchange, continues to create financial harm for users who held positions and have not yet exited
Opportunities
- Supply chain security vendors (Chainguard, Socket.dev, Snyk) can point to this incident to unlock budget for AI-toolchain auditing at developer-heavy organizations
- npm and other registries (PyPI, RubyGems) have a concrete case to accelerate maintainer-abandonment policies and build automated orphaned-package flagging tooling
- The get-shit-done-redux fork gains immediate credibility as a community-vetted alternative, positioning its maintainers as trusted stewards for the existing user base
What we don't know yet
- Total financial value drained from the $GSD token pool before the creator disappeared -- no confirmed figure in public reporting as of May 22, 2026
- Whether npm has been formally notified and is actively reviewing the original get-shit-done packages for removal, transfer, or deprecation notice
- Identity of the original developer -- community investigation is ongoing with no attribution confirmed in available public reporting
Originally reported by reddit.com
Read the original article →Original headline: r/ClaudeAI: 'Get Shit Done' AI Coding Tool Creator Pulls Crypto Rug Scam — Community Forks to get-shit-done-redux, Urges Immediate Removal of Original npm Packages