> Did the malware wait for me to open my keepass vault and snoop the password then?
It's not impossible at least. There's been vulnerabilities in Keepass RPC which allowed any javascripts on Internet reading your passwords [1]. If a simple javascript can read secrets from keepass, I would not be at all surprised if that has happened.
> the less probable it is that we were all hit with the same malware.
Sure. But there's also some selection bias here, were a lot of people visiting hackernews is affected. On twitter, everyone (more or less) who's discussing this issue links this post, which at least in theory could indicate that the scope of the issue is relatively narrow (compared to the entire internet). It could be that some specific developer tools or libraries have been affected for example (as any of the recent packages on NPM which people claim may have sniffed credentials).
1: https://forum.kee.pm/t/a-critical-security-update-for-keepas...