Security

Once the package is on the party which is doing the update could it be decoded and source revealed

Assuming you upload normally (and not with 'save on send') the JS code will be fragmented over the memory area, and then compressed. With a huge amount of difficulty, it could be decoded (but even I'd struggle). The best solution would be to turn on minification when you upload your code to Espruino, which would make the uploaded code almost unreadable even if it could be deciphered.

At that point it's going to be much more difficult to work anything out from your code than it would be if someone disassembled compiled C code, so I really wouldn't worry about it.

You could translate your JS code to C (or for simple functions you can use http://www.espruino.com/Compilation), but I wouldn't advise it. Personally I'd say the difficulty of reverse engineering minified JS after it's been encoded into datastructures and compressed with heatshrink makes it about as difficult as you're going to get.