How do you protect yourself
Firefox addons from the official site are put through the addon review proces https://addons.mozilla.org/en-US/developers/docs/policies/reviews
So you can check if an addon is official and has been reviewed before installing.
It's not 100% You can find a list of blocked addons removed by Mozilla due to given reasons (viruses, trojans, etc.) https://addons.mozilla.org/en-US/firefox/blocked/
How does the maleware work?
The .xul file contains the following line of code:
So when you test this script on your own account it will be sending him the your password. For this reason you should delete this addon and change your password.