@keepassxc in my opinion this is not a victimless crime
this is willful deceipt and if you want to cross your t's I would even argue it's a threat to national security.

KeePassXC does irreplaceable work for security for companys, agencys and individuals. Spreading malware by pretending to have a poisoned supply chain thus is a direct threat to the country of whomever judge reads this.
When not done on purpose then it's dangerous ignorance and thus no legal way out