There is a specific subsection of the CFAA that applies to this situation (deployment of unauthorized code that makes its way into non consenting systems).

This was a bold and unwise exercise, especially if you’re an academic in country on a revocable visa who participated.