Is it unauthorised if a user chooses to add the package themselves? This is not being put into anyone's machine clandestinely. It is the software user's responsibility to ensure the software is doing what you expect.
He's looking at state level:
if charged as a misdemeanor, the crime is punishable by: imprisonment in county jail for up to one year, and/or a maximum fine of $5,000.6
If charged as a felony, the offense is punishable by: imprisonment for up to three years, and/or a maximum fine of $10,000.7
Federal charges I'm not sure about.