Reading the content the problem does not start with a plugin in Obisidian store but rather with a malicious vault they lure you to open.