malware issue

I have got this from a site visitor who reported that the plugin fired a prompt to download malware coming from the following

”

If you decode that command, it is making a call to download and then run the file at “https://compos18.azureedge.net/doc-YUSKQOPZUFD” The interesting thing here is that your website loads a javascript file named “tracking” from metrica2.azureedge.net as requested by the plugin yith-woocommerce-order-tracking. This is still happening right now. I would have to inspect the code to understand why it’s not activating the file download like it did to me the first time – perhaps as simple as a random trigger to make it hard to find.

“