As others have said, it's basically impossible to determine outside of some specific cases. Like, imagine if the keystroke data was being sent on its own to a u

As others have said, it's basically impossible to determine outside of some specific cases. Like, imagine if the keystroke data was being sent on its own to a unique endpoint; or a single player game that was sending only keystroke data to a remote server and little else. This is tangential, but for all the flack Wayland gets compared to X11, it does at least provide some reassurance that a program can only easily keylog the stuff you enter into that program.