Malware infected h5p

I use the latest version of h5p and wordpress. 

2 weeks ago, malware appeared to me site. Malware is call wp-vcd and infected function.php by adding about 120 lines of code. When i delete that unnecessary code and unnecessary files created by malware, h5p stops working. No error in inspect or wp debug. In order for h5p to work I have to do a site backup, and the malware come back.

Can you help me with that problem?