Spam link injections in plugin

i bought easy table of contents module for wordpress from them but it does not work as expected. i asked them to check. they gave me a new module file to upload to my website but it has spam link injections as blocked by cloudflare. i asked them to give updated module through their official channel which they said will do but never did it. they are just trying to spent time. i asked them to refund multiple times but they donot reply. theeir terms and cond clearly states that payment is refunded if they are unable to resolve issue of customer.