LayerSlider WP inserts malicious code

Dear Team,

I have installed Enfold theme in a completely fresh directory and used LayerSlider WP to add a slider on home page.

As soon as I make changes to slider and save it, it creates a file wp-tmp.php inside wp-includes folder which contains malicious scripts.
Due to these scripts, Google Ads has disapproved my ads from running.

I am not using any other plugins except: Yoast SEO and Jetpack.

I dont know if LayerSlider is part of Enfold or it is a separate plugin, however, it gets installed automatically with Enfold.

Please guide how to resolve this.