The scammers try to fake everything. But what is hardest to fake is an alive community. This is especially hard on new developers, since they struggle to garner a community of players.
They know why they publish their scams on hacked accounts. Those look a bit alive and are older, some even with published projects and a dozen or more followers. Payment options are also in the account, so there are paid and pay what you want scams around.
The scams uploaded here often do not get detected even on virustotal, where they use like 70 different scanners...
Sandboxing seems the way to go for not yet trusted developers.