What law does it break if you publish a package that displays a popup and somebody else voluntarily downloads and executes it? There's no maliciousness, no harm

What law does it break if you publish a package that displays a popup and somebody else voluntarily downloads and executes it? There's no maliciousness, no harm done, yet somebody would find a way to get you prosecuted for it because the legislation is vague and 30 years behind. Meanwhile the actual bad guys are getting away with draining bank accounts and dumping databases with millions of peoples' personal information.