detect system commands

[fraxken]

see: https://socket.dev/npm/package/uplex-child-process/files/8.1.2/index.js

Please add other examples in this thread

[fraxken]

relate: #327

[fraxken]

unsafe-command has landing in master branch, we need to dig new patterns of commands to extend the detection.

[fraxken]

Other real world examples:

• https://socket.dev/npm/package/aog-checker/files/99.99.99/index.js
• https://socket.dev/npm/package/mydummyproject-zyp/files/99.9.9/index.js

[tony-go]

The next step is to parse the value of TemplateLiteral properly. We currently assume that there is only one element in the quasis property while in fact we could have an array of values that will eventually conduct to the full string.