The autocomplete provides a valuable service: it shows you suggestions for search terms; it's similar to if the credit card number is sent to the server and the server sends back whether or not the number is a valid credit card number (although this is now done on the client side).

It can also be turned off extremely easy, not exactly what we know as "malware" if it allows you to turn off its "malicious" activities.