which() should only return a value if it finds a matching file in the PATH and that file is executable.

I'm not sure if it's possible to reliably check executability on Windows, but this should at least be done for unix. This section of the docs suggests a way of using fs.statSync() to check this info.

The right way would be to also check if the current user matches the user, group, or all fields as well, but I think this might be tricky. It should be sufficient to just assume that we do have a match, and just do an OR of all three (ex. userCanExecute() || groupCanExecute() || allCanExecute()).