Over a year and a half ago I was recruited by a company that told me they were writing antivirus software. I found out today that they don't have contracts with legitimate customers, and may be actually planning to sell to unscrupulous individuals. I originally thought that my work would only be used as a research tool. Recently, I started to question my employer about the need for certain features.
My concerns were dismissed, but I've recently noticed in our github logs that an external contractor is writing a "forcible" installer for "unattended installs", which seems to use some pieces of my work to install without the knowledge of the user.
What steps can I take to distance myself from this company, and (if necessary) bring attention to their activities without violating my confidentiality agreement? I don't want to be blacklisted in my industry because my boss is a lying criminal.
I work in the US, but occasionally travel to Europe and Canada.