It isn't. This is just the CLI client to their API service. All scanning happens on their servers based on data extracted by the CLI.
I was under the impression there’s no scanning as such whatsoever? It just sends a list of your packages and figures out which one should be upgraded based on what they know.
Yep, it's based on the package dependencies you list, looking for packages with know reported issues.