Seems like this plugin adds refferal links on search page which is not described anywhere on a plugin page :( Once disabled , this behaviour disappered. The invoices are porduced well tho , but this ransomware is not welcome :(

productpicker.xyz/cpa?subid=r00525&link=http s://www.aliexpress.com/item/1005008188505806.html