Putting aside the question of whether these folks are serving malicious JS to users, seeing no network activity at the same time as your keystrokes doesn't tell

Putting aside the question of whether these folks are serving malicious JS to users, seeing no network activity at the same time as your keystrokes doesn't tell you much. The client could easily be caching your keystrokes locally, then uploading in a batch with any AJAX call.