1. Get access to build infrastructure (e.g. via supply chain attack)

2. Inject code in build to export user's passwords to remote server after update is installed

This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years.

Arguably it wasn't secure in the first place if it had backdoor like that.

It doesn't have to a backdoor. A malicious employee can have access to the keys.

This is a good point, but on the other hand, couldn't any application be hijacked in the same way to include a keylogger/upload plaintext password DBs stored locally by browsers/etc? Somehow this hasn't happened on a mass scale that I'm aware of.

Not exactly, because the JavaScript code can change and be delivered at ANY time. No code signature verification is involved.

An offline password manager is updated a few times a year, and will go through OS repository distribution, with verification of the signature for changes. Or you can download the software from the source website and check the signature.

Extension has the passwords so just need to suck them through a straw. Getting a keylogger on someones machine probably requires getting them to run an executable or a zero-day exploit.

Worth noting that open-source projects where your password store is saved locally are vulnerable to the same attack.

Simple, but not easy.

Dependency exploit would be the way for 1Password etc, which are now basically wrapped web apps.

even with everything, given the norms of lock files for even the most basic of web apps, you're still at "need to roll out a client update".

Now that's not to say that something can't be sneaked into other work! But the bar is a bit higher than "take over a dependency"

that's what happend to solarwinds, it out worked pretty well for the hackers there

Web apps are potentially re-downloaded every time you use them.