[Herobrine2084]

Yes, the source code is not open sourced.

But since it's an NPM package, the transpiled and minified code is of course available for automated security scanning (it's not uglified or obfuscated).

I don't think having the project open source will change a lot about security. It's a fairly complex project, and someone manually reviewing of all the code is unlikely.

Also, malicious packages is especially a problem for very common dependencies. And Luna Park is not gonna be a hidden dependency of a lot of packages.

On a side node, maybe the editor code will go Open Source someday, but since there's no way back to that decision, I'm taking time to reflect on this.