Perhaps they are 100% legit, but assuming they are not:

* Some trick to use your project to show spam???

* Some trick to scam you, because you "must" install something so they send you the money???