If someone gained access to a self-hosted instance, that would certainly be possible. But if an attacker were able to get the user's passwords, they would need to send them to a remote server or login back into the instance to get the data.
With a self-hosted instance, I would be more concerned with how data is transferred between the server and the client. Do you have a valid SSL certificate installed with strong encryption parameters? Using a self-signed one isn't safe and poses a larger risk than a malicious Javascaript file because it would be harder to detect a network sniffer rather than hack into a server. You could also be susceptible to a man-in-the-middle attack where an attacker forwards you to a server under their control where they can intercept the network traffic and decrypt the data.
Either way, once an attacker has that level of access to a system where they can manipulate the software like that, they'll probably be able to access the passwords in multiple different ways. The best way to prevent unauthorized access to a self-hosted password manager like the one you're describing is to limit who has access to the server.
- It shouldn't be publicly accessible on the internet
- A firewall should be installed which blocks all ports except the one that is required to be open
- A network firewall rule should also block all ports except the required ones and also grant access to computers that need access.
LastPass has a setting that you have to enable where it requires you to enter your password every time before viewing a password in the password manager.