The Source Is Closed. Here's How You Can Still Trust the Supply Chain.

Security considerations of the GreenOps Scan CLI

Whenever someone asks "why isn't this open source?" about GreenOps Scan, the honest answer is: it isn't. The CLI is free to use — npx greenops-scan runs on your machine, with your credentials, without a login or a paywall — but the source code itself is not published. If you clone github.com/spidgorny/greenops-scan, you'll find a README.md and a LICENSE, not the implementation.

That's a deliberate trade-off, not an oversight, and it's fair to ask what it costs you as a user. If you can't read the code yourself, how do you know it's safe to point at a real AWS account? This post is about the two things you can independently verify — the published package's dependency supply chain and its behavior at runtime — and why both hold up well even without access to the source.

What "closed source" does and doesn't mean here

Closed source means you can't read src/providers/aws/modules/ec2.ts on GitHub. It does not mean the package you actually install is a black box: