Likely your site has been hacked. Once a site is hacked, hackers can inject their malicious files anywhere. (That’s how file permissions work; once you have access to the site, you can put files anywhere in it). They tend to drop files into locations belonging to popular plugins (because those are the locations likely to exist, so they hard-code a list of popular plugins in their code). You will want to fully scan your site for all signs of infection (as it’s rare that they just drop a single file in).