It runs locally, and if the attacker has that much access, in most scenarios there isn't anything stopping your adversary from just logging your keystrokes and curling the keystore to a remote server.