which() should only return a value if it finds a matching file in the PATHand that file is executable.

I'm not sure if it's possible to reliably check executability on Windows, but this should at least be done for unix.This section of the docs suggests a way of usingfs.statSync() to check this info.

The right way would be to also check if the current user matches theuser,group, orall fields as well, but I think this might be tricky. It should be sufficient to just assume that we do have a match, and just do an OR of all three (ex.userCanExecute() || groupCanExecute() || allCanExecute()).