A quick way I would assess a site would be to run a VM with a network monitor on and monitor what is being sent from the site (and to where). After all, an attacker somehow needs to collect those logged data points.
If nothing shows up, I'd then go into the code itself. I'd use a javascript debugger and see exactly what functions were being fired when I typed something...
It all really depends on how the attacker programmed it...
If you are paranoid (like me;) you could just run NoScript as well.
update
In response to your comments I will elaborate on how to setup a secure environment for malware analysis.
Generally, it is considered good practice to always analyze malware (or suspected malware) inside an isolated environment. The easiest way would be to setup a virtual machine (IE Virtual Box) running a linux distro (I recommend Helix as it has all the forensic tools built in).
Once you have the VM setup (make sure you do not give it network access and basically only configure it to have very limited access to the host machine), you can then perform your analysis.
Now the reasons for performing the examination inside the VM is akin to a biological virologist performing lab work in a secure BSL-3 lab (BSL-4 in cyber security would include air-gap measures and such, but thats a different story).
Of course, if you developed the virus, you would know what it does (presumably) and so could play around wherever.
If your intention is to gain assurance that no malicious alterations have been made to your script as part of a whitebox code security review you are looking for two things:
As mentioned elsewhere - ultimately someone will be trying to exfiltrate the data. At this point you are looking for:
